General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
231229-pnpdpadffj
-
MD5
8024af6152ce6dc1c65c57b9e2c88017
-
SHA1
b3683f398f36b35d4e1ed5af789521a1aa07c11c
-
SHA256
118be55a76743e05e33251b51cad97c46de6ba3fe7090ad65dc3a5400f45979d
-
SHA512
e28089ca4cec5f79f3ce7770e424535e891a4eb1cb0b8de204083d4c7b4791be4e33b55b746fd22fd7d1597ebb2f90e5fb75c91641aebe5fe2f352afb9080791
-
SSDEEP
49152:KvmI22SsaNYfdPBldt698dBcjHIGxNESERk/iFLoGdAhdaTHHB72eh2NT:Kvr22SsaNYfdPBldt6+dBcjHBxEd+
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.178.197:4782
05067353-87c9-4866-b3d2-14f9329a849b
-
encryption_key
837E13811BD83BAE347955143D2609140A707338
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
8024af6152ce6dc1c65c57b9e2c88017
-
SHA1
b3683f398f36b35d4e1ed5af789521a1aa07c11c
-
SHA256
118be55a76743e05e33251b51cad97c46de6ba3fe7090ad65dc3a5400f45979d
-
SHA512
e28089ca4cec5f79f3ce7770e424535e891a4eb1cb0b8de204083d4c7b4791be4e33b55b746fd22fd7d1597ebb2f90e5fb75c91641aebe5fe2f352afb9080791
-
SSDEEP
49152:KvmI22SsaNYfdPBldt698dBcjHIGxNESERk/iFLoGdAhdaTHHB72eh2NT:Kvr22SsaNYfdPBldt6+dBcjHBxEd+
-
Quasar payload
-
Executes dropped EXE
-