General
-
Target
sdfsas.exe
-
Size
3.1MB
-
Sample
230803-trdtksfe3z
-
MD5
3f97b2b4461a6ce9e500a4cb55921cda
-
SHA1
fa6218a73cb09b59d72fd7d333f5f04189b9e1c5
-
SHA256
b14bbe263db5f50630fe57fa7645bc69f7d6e41d236a6f72aa6657a2d7d1fcf7
-
SHA512
0b1ac352f258cb2b5f34ca188f0455dcff52f43e594fdb71a688814f2ca80cb95f55ad14423857b6bedc18a22daf46ed7bb46cbbe21ca961b5db4c66ce805916
-
SSDEEP
49152:rvye821/aQWl8P0lSk3aKA3Z+nq4mgmzrLoGdPTHHB72eh2NT:rvJ821/aQWl8P0lSk3DA3Z+nq4mh
Behavioral task
behavioral1
Sample
sdfsas.exe
Resource
win7-20230712-en
Malware Config
Extracted
quasar
1.4.1
Infected
192.168.1.1:4782
192.168.1.66:4782
dark-crystal.at.ply.gg:4782
169.254.68.129:4782
ff410ede-beff-4970-8e12-7d251057f1fd
-
encryption_key
1B172706DED462B59F2A5056AB06A8DD1EE8491B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Realtek Audio
-
subdirectory
SubDir
Targets
-
-
Target
sdfsas.exe
-
Size
3.1MB
-
MD5
3f97b2b4461a6ce9e500a4cb55921cda
-
SHA1
fa6218a73cb09b59d72fd7d333f5f04189b9e1c5
-
SHA256
b14bbe263db5f50630fe57fa7645bc69f7d6e41d236a6f72aa6657a2d7d1fcf7
-
SHA512
0b1ac352f258cb2b5f34ca188f0455dcff52f43e594fdb71a688814f2ca80cb95f55ad14423857b6bedc18a22daf46ed7bb46cbbe21ca961b5db4c66ce805916
-
SSDEEP
49152:rvye821/aQWl8P0lSk3aKA3Z+nq4mgmzrLoGdPTHHB72eh2NT:rvJ821/aQWl8P0lSk3DA3Z+nq4mh
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-