General
-
Target
client.exe
-
Size
3.1MB
-
Sample
231120-2mty1abc71
-
MD5
cac610eeae60d8291a852ad9dda90c81
-
SHA1
d97afeabdc465c60ba040becfbc5abde19ec9326
-
SHA256
7fbdff8ee9930b76ae1ca9310f493ae700e1f7c9aa1b32c47fca64a240317ed4
-
SHA512
887edd3ac530c3014aea7d8aab97756aabf250c5cecf01c837a19787403ca6dcb0ed1e84a6842af69c4418e14e7bd9327762db228344229df24ff536ae81d2e5
-
SSDEEP
49152:uvct62XlaSFNWPjljiFa2RoUYIy6RJ6LbR3LoGduTHHB72eh2NT:uvg62XlaSFNWPjljiFXRoUYIy6RJ6d
Behavioral task
behavioral1
Sample
client.exe
Resource
win7-20231023-en
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.1:7777
e74501e4-0d13-44ea-ab56-f5adb400d53b
-
encryption_key
122EFF89481AC09109CB9613ECDFDD3EE770EBD3
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
300000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
client.exe
-
Size
3.1MB
-
MD5
cac610eeae60d8291a852ad9dda90c81
-
SHA1
d97afeabdc465c60ba040becfbc5abde19ec9326
-
SHA256
7fbdff8ee9930b76ae1ca9310f493ae700e1f7c9aa1b32c47fca64a240317ed4
-
SHA512
887edd3ac530c3014aea7d8aab97756aabf250c5cecf01c837a19787403ca6dcb0ed1e84a6842af69c4418e14e7bd9327762db228344229df24ff536ae81d2e5
-
SSDEEP
49152:uvct62XlaSFNWPjljiFa2RoUYIy6RJ6LbR3LoGduTHHB72eh2NT:uvg62XlaSFNWPjljiFXRoUYIy6RJ6d
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-