General
-
Target
uac.exe
-
Size
3.1MB
-
Sample
230605-c6lz3aef43
-
MD5
e63d1cf98aea7e0c5cc065f0440c2302
-
SHA1
725eba5865333411427c4d4982d0fb3b67a7abe5
-
SHA256
97220df24082531400482d4e55cac0cc62fb04e3cde49b85a188e14b09ae43a0
-
SHA512
0a5c3857b41b5008ed2cf3414194bbf9a2ed45dc71094125c7993b8f50effce6484f24d3afcc0f073e47b628cd17946fefa2120274004e8fc073023f6377dfa2
-
SSDEEP
49152:3v3I22SsaNYfdPBldt698dBcjHnWUPR4oGdrMTHHB72eh2NT:3v422SsaNYfdPBldt6+dBcjHnWUPW7
Behavioral task
behavioral1
Sample
uac.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
uac.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
quasar
1.4.1
Discord Updater
34.95.169.39:9000
microsotf.ddns.net:9000
22bc5714-c575-411a-b7a5-56b481508a31
-
encryption_key
DD11DD94FCA2BC6D9E7164A7520569590E885EE8
-
install_name
Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Updater
-
subdirectory
Discord Updater
Targets
-
-
Target
uac.exe
-
Size
3.1MB
-
MD5
e63d1cf98aea7e0c5cc065f0440c2302
-
SHA1
725eba5865333411427c4d4982d0fb3b67a7abe5
-
SHA256
97220df24082531400482d4e55cac0cc62fb04e3cde49b85a188e14b09ae43a0
-
SHA512
0a5c3857b41b5008ed2cf3414194bbf9a2ed45dc71094125c7993b8f50effce6484f24d3afcc0f073e47b628cd17946fefa2120274004e8fc073023f6377dfa2
-
SSDEEP
49152:3v3I22SsaNYfdPBldt698dBcjHnWUPR4oGdrMTHHB72eh2NT:3v422SsaNYfdPBldt6+dBcjHnWUPW7
Score10/10-
Quasar payload
-
Executes dropped EXE
-