General
-
Target
Update.exe
-
Size
3.4MB
-
Sample
231226-bt8smaahdk
-
MD5
f18ad4d563f71b31f1671cc53254ceed
-
SHA1
10717c0e669dfb725a227031142fea305189c741
-
SHA256
42ade491c67312ca29a4d2ab39df56ce9dd29f6c76c8064bd2f87383e814a9eb
-
SHA512
dff0521b3d80e1f507503a675854a87a9a3da785870485fd184532229622feceb855a55822ee68a629415e810fc77e25b58b10d25cb88c42f5215e97ad185890
-
SSDEEP
49152:VveY52fyaSZOrPWluWBuGG5g5hNoxNESEsk/iBLoGdP7THHB72eh2NT:VvD52fyaSZOrPWluWBDG5g5hixPR/
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.1:8080
deea5660-2f39-4957-bcd5-65760e4d31d5
-
encryption_key
8FCEDB55570386C448925A259E1B3D0E6D844CE4
-
install_name
Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update2.exe
-
subdirectory
SubDir
Targets
-
-
Target
Update.exe
-
Size
3.4MB
-
MD5
f18ad4d563f71b31f1671cc53254ceed
-
SHA1
10717c0e669dfb725a227031142fea305189c741
-
SHA256
42ade491c67312ca29a4d2ab39df56ce9dd29f6c76c8064bd2f87383e814a9eb
-
SHA512
dff0521b3d80e1f507503a675854a87a9a3da785870485fd184532229622feceb855a55822ee68a629415e810fc77e25b58b10d25cb88c42f5215e97ad185890
-
SSDEEP
49152:VveY52fyaSZOrPWluWBuGG5g5hNoxNESEsk/iBLoGdP7THHB72eh2NT:VvD52fyaSZOrPWluWBDG5g5hixPR/
-
Quasar payload
-
Executes dropped EXE
-