Overview

overview

10

Static

static

10

138ab3d712...91.exe

windows7-x64

10

138ab3d712...91.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

  • Size

    3.1MB

  • Sample

    250130-ggp3msyper

  • MD5

    097568748bb3dc42a29f6982d1fc4ac3

  • SHA1

    b7e45e9dd14adc29d59eca162c57d747ad229fcb

  • SHA256

    138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

  • SHA512

    22ecd01b0534718b19d9af0bf369184c8e703e7ad76ef6ed49f7168d1ede3f512311aca9ce5de2b32cac016377bf84529f5b05a26b88c85bb303142445cf3698

  • SSDEEP

    49152:3vXI22SsaNYfdPBldt698dBcjH0tk+GoGZyTHHB72eh2NT:3vY22SsaNYfdPBldt6+dBcjHEk1

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

81.161.238.80:4444

Mutex

4e2e78da-feaf-429e-aac4-9ee8a177bbf1

Attributes
  • encryption_key

    F67E99F78BCB3DE5163C575051A85C1166CAAB55

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

    • Size

      3.1MB

    • MD5

      097568748bb3dc42a29f6982d1fc4ac3

    • SHA1

      b7e45e9dd14adc29d59eca162c57d747ad229fcb

    • SHA256

      138ab3d7129533eeeb90d9595fd199fc8f678511fb53a41836e912f5ef7c9591

    • SHA512

      22ecd01b0534718b19d9af0bf369184c8e703e7ad76ef6ed49f7168d1ede3f512311aca9ce5de2b32cac016377bf84529f5b05a26b88c85bb303142445cf3698

    • SSDEEP

      49152:3vXI22SsaNYfdPBldt698dBcjH0tk+GoGZyTHHB72eh2NT:3vY22SsaNYfdPBldt6+dBcjHEk1

    Score
    10/10
    quasaroffice04spywaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks