General
- Target Client-built.exe
- Size 3.1MB
- Sample240106-ltke5scgcl
- SHA256 4e01c76200fe5e4cde437fdd12b42c9d2c884018b7f9b89e097ff53ee4e75ec9
- MD5 0b665294ec2063215cdc72c07caa5bce
- SHA1 1c2312f39df0b516def74ce8e925c33191275ff3
- SHA512 3c56ab85b5732dd2cd0dabdd4e78065665f55a2a5ba3a686c083fd4e91ddd4c7b401d089c0881ac4188c4911aa9ec62dd3715c5a2cae19f525c52f59074c919a
- SSDEEP 49152:PvbI22SsaNYfdPBldt698dBcjHXYRJ6pbR3LoGdKTHHB72eh2NT:Pvk22SsaNYfdPBldt6+dBcjHXYRJ6r
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
91.92.251.28:4782
Mutex
-
03ac8289-d1ca-4c45-b72e-cb527f9b533f
Attributes
-
encryption_key
F066F62E3A3BF55E3BA0EA3F7564B292EB48EE92
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target Client-built.exe
- Size 3.1MB
- SHA256 4e01c76200fe5e4cde437fdd12b42c9d2c884018b7f9b89e097ff53ee4e75ec9
- MD5 0b665294ec2063215cdc72c07caa5bce
- SHA1 1c2312f39df0b516def74ce8e925c33191275ff3
- SHA512 3c56ab85b5732dd2cd0dabdd4e78065665f55a2a5ba3a686c083fd4e91ddd4c7b401d089c0881ac4188c4911aa9ec62dd3715c5a2cae19f525c52f59074c919a
- SSDEEP 49152:PvbI22SsaNYfdPBldt698dBcjHXYRJ6pbR3LoGdKTHHB72eh2NT:Pvk22SsaNYfdPBldt6+dBcjHXYRJ6r
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload