General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
231104-mxqa8sae22
-
MD5
5b6cf3311c43042e7c34d4245e837e49
-
SHA1
2056489c9934a88ef0e0654c4ae2a26ee4b62f60
-
SHA256
62de60b59a7e50201894f528b124dc94c072c9db3904494d194b0c7f8be5a4f7
-
SHA512
0b715f1c8d50333c35f8ef1d39fe7546b4e9bd9c5012e1df6dad739a0cefa2e56ea42837800e7b5b664e413a624156c559a5df1bbb9dacc6a3417ccc3556d966
-
SSDEEP
49152:DvBt62XlaSFNWPjljiFa2RoUYIfkxNESEVk/ijLoGdHTHHB72eh2NT:Dvr62XlaSFNWPjljiFXRoUYI8x4v
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20231020-en
Malware Config
Extracted
quasar
1.4.1
Office04
serverlolxd.ddns.net:4782
d8c275e5-18fa-4e81-8ec8-a1df4d7051cd
-
encryption_key
55134B4B269EA9FF5C0DE96378EBD7CC33C096F6
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
5b6cf3311c43042e7c34d4245e837e49
-
SHA1
2056489c9934a88ef0e0654c4ae2a26ee4b62f60
-
SHA256
62de60b59a7e50201894f528b124dc94c072c9db3904494d194b0c7f8be5a4f7
-
SHA512
0b715f1c8d50333c35f8ef1d39fe7546b4e9bd9c5012e1df6dad739a0cefa2e56ea42837800e7b5b664e413a624156c559a5df1bbb9dacc6a3417ccc3556d966
-
SSDEEP
49152:DvBt62XlaSFNWPjljiFa2RoUYIfkxNESEVk/ijLoGdHTHHB72eh2NT:Dvr62XlaSFNWPjljiFXRoUYI8x4v
-
Quasar payload
-
Drops file in System32 directory
-