Overview

overview

10

Static

static

10

Client-built.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    5ff1c7a31e2aeb8f5e998884bd5bcdd3

  • SHA1

    f02a220ced830d2ac29d42a3cc4c72a68b9f4068

  • SHA256

    45a7baa72cc53ffec5c9c7c8f4bef8ca6323f24a43c6f0baec29c70f3bbfce35

  • SHA512

    47ab416e032b917745acb7720411280803676ba63ef195a58786b3a0cba4803d88816e8ae740181e0af8ee1e7bd9dfe3aecfc26a806d19a6efc5e2c1ed4a38d2

  • SSDEEP

    49152:uvIt62XlaSFNWPjljiFa2RoUYI9P541vSLomdeTHHB72eh2NT:uvE62XlaSFNWPjljiFXRoUYI9P59

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.56.1:4782

Mutex

4933039f-7ad7-40a8-b70d-365558f6056c

Attributes
  • encryption_key

    EA7BEE3E368EF7D787AB8E01A4A119314D7B324C

  • install_name

    nigga.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    niggas

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    Password: hi

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections