General
-
Target
b095d2a569dc3b0422af1e0c7f9e0e1160baed04490978bf8c3121ca5244de6c
-
Size
11.3MB
-
Sample
231116-c7n6tafb96
-
MD5
0561318b22680fbea2c18a68c43a1f56
-
SHA1
405df445a274bb9c12f617d3d4269044e13c5880
-
SHA256
b095d2a569dc3b0422af1e0c7f9e0e1160baed04490978bf8c3121ca5244de6c
-
SHA512
575d254b7566d6af7b33ca9608b6a8b8df360a05686514e9d3497458eadfea2bb38bbbe0252030208bc75365373d67ca4c84a6da98500966a693c686ce48df8f
-
SSDEEP
98304:lBfhpArMQgvH22SsaNYfdPBldt6+dBcjHk/bz+Gc4E9PjKjT5QZvG0NDxxi5pXVc:VtBY7jsbzSXe8G0N9xiVjgVIV+lJVgK
Behavioral task
behavioral1
Sample
b095d2a569dc3b0422af1e0c7f9e0e1160baed04490978bf8c3121ca5244de6c.exe
Resource
win7-20231020-en
Malware Config
Extracted
quasar
1.4.1
Office04
frp.deitie.asia:5555
b827dda2-f30e-4465-be3c-2f1d6a93d4a7
-
encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
b095d2a569dc3b0422af1e0c7f9e0e1160baed04490978bf8c3121ca5244de6c
-
Size
11.3MB
-
MD5
0561318b22680fbea2c18a68c43a1f56
-
SHA1
405df445a274bb9c12f617d3d4269044e13c5880
-
SHA256
b095d2a569dc3b0422af1e0c7f9e0e1160baed04490978bf8c3121ca5244de6c
-
SHA512
575d254b7566d6af7b33ca9608b6a8b8df360a05686514e9d3497458eadfea2bb38bbbe0252030208bc75365373d67ca4c84a6da98500966a693c686ce48df8f
-
SSDEEP
98304:lBfhpArMQgvH22SsaNYfdPBldt6+dBcjHk/bz+Gc4E9PjKjT5QZvG0NDxxi5pXVc:VtBY7jsbzSXe8G0N9xiVjgVIV+lJVgK
-
Quasar payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-