General
-
Target
tmppenjc48f
-
Size
3.1MB
-
Sample
231117-fzeh7afe38
-
MD5
6401526837d35c83f00cc20d2d387083
-
SHA1
463821949c73ec31b8841c00bb44a1df79ed20c5
-
SHA256
caf572b1ea51e044b92d1e37c6ee9f8bf4dd178cf6c71cff5a3527c7870a397b
-
SHA512
70a89fd3c03888ca78ebd5323626a68a0f4555dc1247a87a72c8b7ef809dcb8ce626eff1e42e2f0aded983266ef512d995f301ebaad154275ed96123d5da34d7
-
SSDEEP
49152:KvWI22SsaNYfdPBldt698dBcjHUPX/1BxRgoGdFuTHHB72eh2NT:Kv722SsaNYfdPBldt6+dBcjHM/I1
Behavioral task
behavioral1
Sample
tmppenjc48f.exe
Resource
win7-20231025-en
Malware Config
Extracted
quasar
1.4.1
Office04
193.161.193.99:58530
54af0e48-5a33-4746-8a98-01dcf13783ba
-
encryption_key
3A62B341BAB9ECBB32B7C8FEE43F79FE46244413
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
tmppenjc48f
-
Size
3.1MB
-
MD5
6401526837d35c83f00cc20d2d387083
-
SHA1
463821949c73ec31b8841c00bb44a1df79ed20c5
-
SHA256
caf572b1ea51e044b92d1e37c6ee9f8bf4dd178cf6c71cff5a3527c7870a397b
-
SHA512
70a89fd3c03888ca78ebd5323626a68a0f4555dc1247a87a72c8b7ef809dcb8ce626eff1e42e2f0aded983266ef512d995f301ebaad154275ed96123d5da34d7
-
SSDEEP
49152:KvWI22SsaNYfdPBldt698dBcjHUPX/1BxRgoGdFuTHHB72eh2NT:Kv722SsaNYfdPBldt6+dBcjHM/I1
-
Quasar payload
-