Overview

overview

10

Static

static

10

e026a06e96...63.exe

windows7-x64

10

e026a06e96...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e026a06e96e80ad0a4c72b7ebe9a4a63.bin

  • Size

    3.1MB

  • MD5

    e026a06e96e80ad0a4c72b7ebe9a4a63

  • SHA1

    c10e4ab92083ed4c1c64494a10c3fb71881a78a0

  • SHA256

    cde1b350791fbef921b7bc2241e74820f8f8c3bb12910d501e201de4df407c6c

  • SHA512

    a613cb2777bdcd471414f0d83e69be0b84446c2810b73156cc385c92eb437ef93950581d840a8d89e0e78ccaab3d817389b4ddc2dd8eb13a988d4e94cf852617

  • SSDEEP

    49152:PvTlL26AaNeWgPhlmVqvMQ7XSKnVWDgdhLvJwCoGdyTHHB72eh2NT:PvJL26AaNeWgPhlmVqkQ7XSK9hL

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

performance-ha.gl.at.ply.gg:33365

Mutex

ba5220e2-c4e8-4381-aad8-a85115ef955e

Attributes
  • encryption_key

    67C139F3E9A16FF8132A3DCF42197B8BA3C38609

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e026a06e96e80ad0a4c72b7ebe9a4a63.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections