General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240407-v8mcqaaa6t
-
MD5
2aebe66b019df4695fe7218875c93856
-
SHA1
646890986ef0bba4eed6b659d56704d09e414562
-
SHA256
ea3003e00c6e653fad8844d4677ceef7b7b6e499939ed765a49df3898ddf3c45
-
SHA512
7391db69d5cc021dee50b2af12d11b30a4225f46b4469d10eff4e659c71c298233dea01e1e626d35d49b9490ef3dcaa1570b4448859d9d04ac0270b71c84bddc
-
SSDEEP
49152:WvbI22SsaNYfdPBldt698dBcjHHyxNESEXk/ijLoGdAwXTHHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHSxavD
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
x.tcp.ngrok.io:16096
755f883f-4d58-4349-bc9e-f21c4e163b6f
-
encryption_key
EE65D8F2E429F4900E3A17963595716D863A2455
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
2aebe66b019df4695fe7218875c93856
-
SHA1
646890986ef0bba4eed6b659d56704d09e414562
-
SHA256
ea3003e00c6e653fad8844d4677ceef7b7b6e499939ed765a49df3898ddf3c45
-
SHA512
7391db69d5cc021dee50b2af12d11b30a4225f46b4469d10eff4e659c71c298233dea01e1e626d35d49b9490ef3dcaa1570b4448859d9d04ac0270b71c84bddc
-
SSDEEP
49152:WvbI22SsaNYfdPBldt698dBcjHHyxNESEXk/ijLoGdAwXTHHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHSxavD
-
Quasar payload
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-