Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    73c23b1192bfd4f2fd59ca10523e13f2

  • SHA1

    587f13586069971b5fb715a66aa498c36510a5dc

  • SHA256

    d9db91945538a06bb9f9fd23cdba8b769953b654486c9d6ef85e891c58df2ffd

  • SHA512

    07195c5b5f75aa682a5957e5f1bd440dd6b4cce1b6a4fd76ae0a9d621d8b32e25633178b71bffb02bb0c8af482dc00863e29a18e016694d8cfd5fb89740d32ec

  • SSDEEP

    49152:HvLlL26AaNeWgPhlmVqvMQ7XSKOfsqIBe9joGARVTHHB72eh2NT:HvxL26AaNeWgPhlmVqkQ7XSKOEqZ

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.10.126:52427

94.31.108.129:52427
Mutex

8338883e-e167-4933-893d-9116970a5a7e

Attributes
  • encryption_key

    FFFB8904E2A834B666E9B38240430975448158C8

  • install_name

    pcimprover.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft-Imrpover

  • subdirectory

    find

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.