General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240330-3vve6shf3z
-
MD5
140ba91b54b2acf429d7e75a13caeb18
-
SHA1
e3ea0109d58ac9e910dbeb1b62c3bef6f291dba2
-
SHA256
1eed991a56a7502098e609107529d75bc3945f25436998d3d482a0b8adf63592
-
SHA512
2c83f7336c6226cabbef55be1d9509d1ff616d24aa79fe1d47475126048423ade2ad560f5f304adf8e928b0897d491fcb63ab9824288807b5793d69cbb81ab45
-
SSDEEP
49152:CvchBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkafCp1Jn+oGddETHHB72eh2NT:CvWt2d5aKCuVPzlEmVQ0wvwffCI
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Quasar
140.238.91.110:42341
0e8e41e6-9099-467f-a6ec-db817501dcc7
-
encryption_key
E6C50EA35F1AB6A8B7E919CD72CECF2C57B6D1AE
-
install_name
WindowsUpdater.exe
-
log_directory
Windows Error Logs
-
reconnect_delay
3000
-
startup_key
Windows Boot Menu x64
-
subdirectory
Windows
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
140ba91b54b2acf429d7e75a13caeb18
-
SHA1
e3ea0109d58ac9e910dbeb1b62c3bef6f291dba2
-
SHA256
1eed991a56a7502098e609107529d75bc3945f25436998d3d482a0b8adf63592
-
SHA512
2c83f7336c6226cabbef55be1d9509d1ff616d24aa79fe1d47475126048423ade2ad560f5f304adf8e928b0897d491fcb63ab9824288807b5793d69cbb81ab45
-
SSDEEP
49152:CvchBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkafCp1Jn+oGddETHHB72eh2NT:CvWt2d5aKCuVPzlEmVQ0wvwffCI
-
Quasar payload
-
Executes dropped EXE
-