Overview

overview

10

Static

static

10

Bootstrapp...3).exe

windows7-x64

10

Bootstrapp...3).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper_v2.19 (3).exe

  • Size

    3.1MB

  • Sample

    250206-vvsyca1ndy

  • MD5

    ef984ec5aacb3939bbe64180c7e1f84c

  • SHA1

    25eb03b44465cd9b44da6d422df703bb41abd0e1

  • SHA256

    9a67ba0b0977ff291dc341c37a862d73242d005d5ac38ad1e7583f2d30273d41

  • SHA512

    d338d4ddb9073e2aebbf29a20ae83c02e979e4284d85dc905506dd098d36aa94f39483895f3e96619d33aad2dd34f537acf42eb6ba00756441d699eefff956d6

  • SSDEEP

    49152:3vSI22SsaNYfdPBldt698dBcjHbqRJ65bR3LoGdLTHHB72eh2NT:3v/22SsaNYfdPBldt6+dBcjHbqRJ67

Score
10/10
quasaroffice04persistencespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

26.20.187.152:4782

Mutex

035609b7-5296-42b1-ba51-47722e1900ad

Attributes
  • encryption_key

    EF9AF063C4E9C62FBBA2D6F12350A5C2F573D811

  • install_name

    Bootstrapper_v2.19.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft

  • subdirectory

    SubDir

Targets

    • Target

      Bootstrapper_v2.19 (3).exe

    • Size

      3.1MB

    • MD5

      ef984ec5aacb3939bbe64180c7e1f84c

    • SHA1

      25eb03b44465cd9b44da6d422df703bb41abd0e1

    • SHA256

      9a67ba0b0977ff291dc341c37a862d73242d005d5ac38ad1e7583f2d30273d41

    • SHA512

      d338d4ddb9073e2aebbf29a20ae83c02e979e4284d85dc905506dd098d36aa94f39483895f3e96619d33aad2dd34f537acf42eb6ba00756441d699eefff956d6

    • SSDEEP

      49152:3vSI22SsaNYfdPBldt698dBcjHbqRJ65bR3LoGdLTHHB72eh2NT:3v/22SsaNYfdPBldt6+dBcjHbqRJ67

    Score
    10/10
    quasaroffice04persistencespywaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks