General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240403-tzm28afg67
-
MD5
4be081a8a0d977ee7aecb447124d552a
-
SHA1
85b6b7d04223fd184260aa21488b1473dc274108
-
SHA256
459b63571d796e10325601bb4c0ac907b6ad95a4a5c6cb16709fe1f3a4095fa1
-
SHA512
d976c7d28869750df41a5f90268386e4ca3184b79a145cc6f641533bc7dfe0267983ee056957f5a5792e626975c4467f8e4b4738a366ad8769695ca243460bdd
-
SSDEEP
49152:3vbI22SsaNYfdPBldt698dBcjHWXb3PardLoGd3THHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHK32
Malware Config
Extracted
quasar
1.4.1
Office04
fall-paste.gl.at.ply.gg:18171
b587e6ea-3a5e-46d7-ac84-bfe4007d916f
-
encryption_key
553B3648666DFA53E09DA5C22A85D4D2B387E5AD
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4be081a8a0d977ee7aecb447124d552a
-
SHA1
85b6b7d04223fd184260aa21488b1473dc274108
-
SHA256
459b63571d796e10325601bb4c0ac907b6ad95a4a5c6cb16709fe1f3a4095fa1
-
SHA512
d976c7d28869750df41a5f90268386e4ca3184b79a145cc6f641533bc7dfe0267983ee056957f5a5792e626975c4467f8e4b4738a366ad8769695ca243460bdd
-
SSDEEP
49152:3vbI22SsaNYfdPBldt698dBcjHWXb3PardLoGd3THHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHK32
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-