Overview

overview

10

Static

static

10

Bootstrapp...3).exe

windows7-x64

10

Bootstrapp...3).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper_v2.19 (3).exe

  • Size

    3.1MB

  • MD5

    ef984ec5aacb3939bbe64180c7e1f84c

  • SHA1

    25eb03b44465cd9b44da6d422df703bb41abd0e1

  • SHA256

    9a67ba0b0977ff291dc341c37a862d73242d005d5ac38ad1e7583f2d30273d41

  • SHA512

    d338d4ddb9073e2aebbf29a20ae83c02e979e4284d85dc905506dd098d36aa94f39483895f3e96619d33aad2dd34f537acf42eb6ba00756441d699eefff956d6

  • SSDEEP

    49152:3vSI22SsaNYfdPBldt698dBcjHbqRJ65bR3LoGdLTHHB72eh2NT:3v/22SsaNYfdPBldt6+dBcjHbqRJ67

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

26.20.187.152:4782

Mutex

035609b7-5296-42b1-ba51-47722e1900ad

Attributes
  • encryption_key

    EF9AF063C4E9C62FBBA2D6F12350A5C2F573D811

  • install_name

    Bootstrapper_v2.19.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Bootstrapper_v2.19 (3).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections