Overview

overview

10

Static

static

10

Client-built.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    5fdda3302fc0978be2a8719b6139b1cc

  • SHA1

    2fc2f71c361a5506d0960167836e91f33e78d36f

  • SHA256

    6904a5d6cd11daadde8b1fc4ccb2c7d0e357408e06139d16e78b0052be2f07cb

  • SHA512

    87fc7c8dbd8ba38a59273a136287fb89ceec5eb7d6b799a44b10abeed659df0d8c84bf9210d5ad9b9c23df53ea1567b83030db02ae5b6dc345fc2846019b4bf5

  • SSDEEP

    49152:zvqlL26AaNeWgPhlmVqvMQ7XSK3ULRJ65bR3LoGd0kTHHB72eh2NT:zvSL26AaNeWgPhlmVqkQ7XSK3ULRJ67

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

66.113.31.17:7547

Mutex

1218cd45-c0a3-4b27-9809-93fd038609ce

Attributes
  • encryption_key

    55C5E8AA2B9D9174F4392BCE64D3CC8BB7487B6C

  • install_name

    Quasar rat.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    C:\Windows\System32

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections