General
-
Target
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
-
Size
3.1MB
-
Sample
230919-evw21aeg6z
-
MD5
28e03a0e0871a90ee993db029c25ded5
-
SHA1
651f0c06a5d0bf37a8a7987626a89135b5384459
-
SHA256
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
-
SHA512
c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
-
SSDEEP
49152:q+4bzTvij0votBkRPJMMB+9YUkSk+yfzBcpoG9SbTHHB72eh2NT:q+i/i5tBkRPJMM2YUkSk5u
Behavioral task
behavioral1
Sample
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe
Resource
win7-20230831-en
Malware Config
Extracted
quasar
1.4.1
cunt
37.139.129.145:5512
37.139.129.145:5505
5a092138-836c-4206-9af6-8a540736ef07
-
encryption_key
D21B49539C3EA494897D43CF75CBF5F989F0792A
-
install_name
ntoskrnl.exe
-
log_directory
SystemLogs
-
reconnect_delay
3000
-
startup_key
Kernel
-
subdirectory
Kernel
Targets
-
-
Target
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
-
Size
3.1MB
-
MD5
28e03a0e0871a90ee993db029c25ded5
-
SHA1
651f0c06a5d0bf37a8a7987626a89135b5384459
-
SHA256
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
-
SHA512
c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
-
SSDEEP
49152:q+4bzTvij0votBkRPJMMB+9YUkSk+yfzBcpoG9SbTHHB72eh2NT:q+i/i5tBkRPJMM2YUkSk5u
-
Quasar payload
-
Executes dropped EXE
-