General
-
Target
03765899.exe
-
Size
3.1MB
-
Sample
230606-s2mc2aeh81
-
MD5
3b09070c9e87a592744c37b11da765ec
-
SHA1
7cc3c47a526bdff236c386d7104e6a6421105c68
-
SHA256
d465ae9ae6e31167882d3b174e65fb3147ead1574d6cade606a3aa4ae0c5545c
-
SHA512
cb74601a94f6756af762b13955f60b52f508dac2d5b80b7394377b9113c908dee1f578cc1bdf7e18a9cbb742c9fb69565506cf59ec273af4913b77adc9242365
-
SSDEEP
98304:vI/4IIbtPUwyah7/l9jr18zR7CP+FxSh:Qybta7CPyk
Behavioral task
behavioral1
Sample
03765899.exe
Resource
win7-20230220-en
Malware Config
Extracted
quasar
1.4.1
Office04
146.56.36.222:4782
bab74252-734a-4e03-933a-2f4f1e18953d
-
encryption_key
F48794CF898BB4C5B6223D4F472D7C5E4AD2EF9D
-
install_name
yu.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
zhudongfangyu
-
subdirectory
SubDir
Targets
-
-
Target
03765899.exe
-
Size
3.1MB
-
MD5
3b09070c9e87a592744c37b11da765ec
-
SHA1
7cc3c47a526bdff236c386d7104e6a6421105c68
-
SHA256
d465ae9ae6e31167882d3b174e65fb3147ead1574d6cade606a3aa4ae0c5545c
-
SHA512
cb74601a94f6756af762b13955f60b52f508dac2d5b80b7394377b9113c908dee1f578cc1bdf7e18a9cbb742c9fb69565506cf59ec273af4913b77adc9242365
-
SSDEEP
98304:vI/4IIbtPUwyah7/l9jr18zR7CP+FxSh:Qybta7CPyk
-
Quasar payload
-
Executes dropped EXE
-