General
-
Target
495058aeaf20ed292bfd433eb7bfa85c7fca16fd7da9174169327d7ed59a4709
-
Size
3.1MB
-
Sample
231104-jfz8bsfb89
-
MD5
fd498a7e4ed986702fc761ab1c4a81e9
-
SHA1
e692d2d82b6479236d804fcdf1707cc9dc8d83e3
-
SHA256
495058aeaf20ed292bfd433eb7bfa85c7fca16fd7da9174169327d7ed59a4709
-
SHA512
97d0a48a97bc1b330c44610ee33022fa4bc8f1077338ca69eaf627bd2ca6ae6dfdc86a08cf95d79502a93dac6fe72da4fa58b25cea0a9024f3b4c74d52db88c8
-
SSDEEP
49152:evXt62XlaSFNWPjljiFa2RoUYI2DNk9hivJ6LoGdTTHHB72eh2NT:ev962XlaSFNWPjljiFXRoUYIphL
Behavioral task
behavioral1
Sample
495058aeaf20ed292bfd433eb7bfa85c7fca16fd7da9174169327d7ed59a4709.exe
Resource
win7-20231020-en
Malware Config
Extracted
quasar
1.4.1
Office04
172.20.150.175:8808
1eb0a79a-787c-4beb-a7fe-0b2cfd667fa6
-
encryption_key
C29B7F15245870C49876E2EE9D4791A3D8C283C5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1500
-
startup_key
tanium
-
subdirectory
SubDir
Targets
-
-
Target
495058aeaf20ed292bfd433eb7bfa85c7fca16fd7da9174169327d7ed59a4709
-
Size
3.1MB
-
MD5
fd498a7e4ed986702fc761ab1c4a81e9
-
SHA1
e692d2d82b6479236d804fcdf1707cc9dc8d83e3
-
SHA256
495058aeaf20ed292bfd433eb7bfa85c7fca16fd7da9174169327d7ed59a4709
-
SHA512
97d0a48a97bc1b330c44610ee33022fa4bc8f1077338ca69eaf627bd2ca6ae6dfdc86a08cf95d79502a93dac6fe72da4fa58b25cea0a9024f3b4c74d52db88c8
-
SSDEEP
49152:evXt62XlaSFNWPjljiFa2RoUYI2DNk9hivJ6LoGdTTHHB72eh2NT:ev962XlaSFNWPjljiFXRoUYIphL
-
Quasar payload
-
Executes dropped EXE
-