Overview

overview

10

Static

static

10

better.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    better.exe

  • Size

    3.1MB

  • MD5

    47ec64e3d129b23c44f417cbc2a07aa7

  • SHA1

    e65fbcf69e6e808ebe7bc9b13e483c5fc80d5fa2

  • SHA256

    ccb17adb4b57a95a61acb010c01da98dc150be67a85df2ab40ba9d1f078f8373

  • SHA512

    52247a235b708e98efcf977fd109344e16df9c5a9f13ad5afd395df3f009d9ee6edf81fef9d74a31a9fdec1f851e61642912eb9bc8384b39042b70f9d8b7d510

  • SSDEEP

    49152:PvrlL26AaNeWgPhlmVqvMQ7XSKTxPEakPk/LCyoGdzTHHB72eh2NT:PvRL26AaNeWgPhlmVqkQ7XSKTxhv

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

himato667-58401.portmap.host:58401

Mutex

0e2bc079-3316-407c-a26f-115195d9fe5b

Attributes
  • encryption_key

    D14CC6B8490A41A48C1E115285B6932B9A857EA0

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • better.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections