Overview

overview

10

Static

static

10

Bootstrapp...14.exe

windows10-2004-x64

10

Bootstrapp...14.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper v3.14.exe

  • Size

    3.1MB

  • MD5

    16f639c27fead4d665ab798bd4a8c457

  • SHA1

    c596c009318ba3777e962661355a199b9b4ed5e7

  • SHA256

    afe5f6d8d87bb93548faec17805bd3b68f8e7914ac07ad0bfa60ab465fdc5a0a

  • SHA512

    ba71490f2433062dfd07bf84f6e85e06e9fad412e7baaa81c8519d32c09dd97316f3729ec1bc425c49f7eb95601499330baeb86abd7ea92ef071e39823d46ec8

  • SSDEEP

    49152:mv3I22SsaNYfdPBldt698dBcjHw186GBxQ+oGdlR5THHB72eh2NT:mv422SsaNYfdPBldt6+dBcjHl6c

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.62.1:4782

Mutex

948fde50-66bb-4ffd-aeca-4cc76d13c423

Attributes
  • encryption_key

    FE78C5AAB1B8DB7C1492A05B7A35D613C6807754

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Bootstrapper v3.14.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections