General
-
Target
5815ea9a332e6998a7a360564c44e812229bcff03b1ce3249238579eb84ac071
-
Size
4.2MB
-
Sample
240101-m8jmtsheal
-
MD5
aca0df99026327e5edfd36b29901b6dd
-
SHA1
6e20a28c669a98a547511ae244ceeba79fea0b1c
-
SHA256
5815ea9a332e6998a7a360564c44e812229bcff03b1ce3249238579eb84ac071
-
SHA512
64935ff60f1cdd57d9c169dab4d26a8df189605fdf631704de50116361cd9f91938c231e11314f3405f263617c977f536a6a68d37a7096fbf56de0418633a178
-
SSDEEP
98304:bAAJ+AYvsHvH22SsaNYfdPBldt6+dBcjHk/bzT:2wY7jsbzT
Behavioral task
behavioral1
Sample
5815ea9a332e6998a7a360564c44e812229bcff03b1ce3249238579eb84ac071.exe
Resource
win7-20231215-en
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
1.4.1
Office04
frp.deitie.asia:5555
b827dda2-f30e-4465-be3c-2f1d6a93d4a7
-
encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
5815ea9a332e6998a7a360564c44e812229bcff03b1ce3249238579eb84ac071
-
Size
4.2MB
-
MD5
aca0df99026327e5edfd36b29901b6dd
-
SHA1
6e20a28c669a98a547511ae244ceeba79fea0b1c
-
SHA256
5815ea9a332e6998a7a360564c44e812229bcff03b1ce3249238579eb84ac071
-
SHA512
64935ff60f1cdd57d9c169dab4d26a8df189605fdf631704de50116361cd9f91938c231e11314f3405f263617c977f536a6a68d37a7096fbf56de0418633a178
-
SSDEEP
98304:bAAJ+AYvsHvH22SsaNYfdPBldt6+dBcjHk/bzT:2wY7jsbzT
-
Quasar payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-