Overview

overview

10

Static

static

10

BPLogger-main.zip

windows7-x64

1

BPLogger-main.zip

windows10-2004-x64

1

BPLogger-m...er.rar

windows7-x64

10

BPLogger-m...er.rar

windows10-2004-x64

10

BPLogger.exe

windows7-x64

10

BPLogger.exe

windows10-2004-x64

10

tapi.dll

windows7-x64

1

tapi.dll

windows10-2004-x64

1

x64.dll

windows7-x64

3

x64.dll

windows10-2004-x64

3

BPLogger-m...DME.md

windows7-x64

3

BPLogger-m...DME.md

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BPLogger-main.zip

  • Size

    1.2MB

  • MD5

    4f70daa5c48d5a22396f065a816f9b41

  • SHA1

    da08c8711ef8aac407f460e1c8f3f24f53fc81c2

  • SHA256

    77153049f33480d1b665c68aa0732e531f963f9acb04b9e016baafeca3b54dd8

  • SHA512

    dc233af831e31e3e720edb1eeffe36ac2e887f1d048fb8c9a25b5a64c840b68babf8d19b85bcb704f278b7e4edd709d32a6df5d50ed546bafc757d50e07e9c42

  • SSDEEP

    24576:3kjLFxQGJiip1cakQYJu+W4JBuMADnTy4J7aEJk4YfXnDb0FbBpbKEXENPcfVc:UPrQGpEBdJdJBuMqnZJ7aEIfXnDbcbBy

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

wefdwef-34180.portmap.host:34180

Mutex

c4be1726-3f86-4f80-bc7c-0779b06ffeeb

Attributes
  • encryption_key

    97BF1FDCF446A7218FA05296FD8D8F0C41A6B1E7

  • install_name

    Bootstrapper.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Spotify

  • subdirectory

    system32

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • BPLogger-main.zip
    .zip
  • BPLogger-main/BPLogger.rar
    .rar
  • BPLogger.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • README.txt
  • tapi.dll
  • x64.dll
    .dll windows:5 windows x86 arch:x86

    ed595940f57eaeb7b0ee9e2f63d1aa88


    Headers

    Imports

    Exports

    Sections

  • BPLogger-main/README.md