General
-
Target
561d2b135a6200ef094b222eb47af87a.bin
-
Size
3.1MB
-
Sample
240326-cvpltabh22
-
MD5
561d2b135a6200ef094b222eb47af87a
-
SHA1
4db2f2254cae3695a0ffa7ccdc13097db254cd8c
-
SHA256
c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94
-
SHA512
6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094
-
SSDEEP
49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv
Behavioral task
behavioral1
Sample
561d2b135a6200ef094b222eb47af87a.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Slave
140.238.91.110:36039
df49f69a-66a2-4b6e-bb60-18c12b5b14df
-
encryption_key
6A1671418BB270D703D501AB8E9B41E8D413B6D3
-
install_name
Client.exe
-
log_directory
Win64ErrorLogs
-
reconnect_delay
3000
-
startup_key
Windows Boot Menu
-
subdirectory
SubDir
Targets
-
-
Target
561d2b135a6200ef094b222eb47af87a.bin
-
Size
3.1MB
-
MD5
561d2b135a6200ef094b222eb47af87a
-
SHA1
4db2f2254cae3695a0ffa7ccdc13097db254cd8c
-
SHA256
c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94
-
SHA512
6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094
-
SSDEEP
49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv
-
Quasar payload
-
Executes dropped EXE
-