General
-
Target
73e800bd58f15f7547c82a10f8ac9e0613ccd654f9f37a29e55b4b01285443a3
-
Size
4.8MB
-
Sample
231117-vhdb5abd69
-
MD5
de06431dcca0d4d6c7fdcb0034018192
-
SHA1
0bed3bc0023eefcdec74e4ab1ca0e6f7db5d8898
-
SHA256
73e800bd58f15f7547c82a10f8ac9e0613ccd654f9f37a29e55b4b01285443a3
-
SHA512
b57b039f11c5ac57674415a3849f24b52dce330bc1aae355739845c0eaac2ed47e0f132e675fd076919e04edb1529cd430104824a88c63755276a905528ca2f5
-
SSDEEP
98304:oZA+0DyonvH22SsaNYfdPBldt6+dBcjHk/bzdIbzZDIbzZY:UKY7jsbzSeK
Behavioral task
behavioral1
Sample
73e800bd58f15f7547c82a10f8ac9e0613ccd654f9f37a29e55b4b01285443a3.exe
Resource
win7-20231023-en
Malware Config
Extracted
quasar
1.4.1
Office04
frp.deitie.asia:5555
b827dda2-f30e-4465-be3c-2f1d6a93d4a7
-
encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
73e800bd58f15f7547c82a10f8ac9e0613ccd654f9f37a29e55b4b01285443a3
-
Size
4.8MB
-
MD5
de06431dcca0d4d6c7fdcb0034018192
-
SHA1
0bed3bc0023eefcdec74e4ab1ca0e6f7db5d8898
-
SHA256
73e800bd58f15f7547c82a10f8ac9e0613ccd654f9f37a29e55b4b01285443a3
-
SHA512
b57b039f11c5ac57674415a3849f24b52dce330bc1aae355739845c0eaac2ed47e0f132e675fd076919e04edb1529cd430104824a88c63755276a905528ca2f5
-
SSDEEP
98304:oZA+0DyonvH22SsaNYfdPBldt6+dBcjHk/bzdIbzZDIbzZY:UKY7jsbzSeK
-
Quasar payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-