General
-
Target
HEUR-Trojan.MSIL.Quasar.gen-788c859458ab91850978e27a2591b564e5e3200eede844362bf465944db9d92c
-
Size
3.4MB
-
Sample
240415-d1k19add99
-
MD5
a585d666df5ca83eabcd06a4f0364523
-
SHA1
4f5d8d09aaaf33efda276c3f7ab9883eda146da6
-
SHA256
788c859458ab91850978e27a2591b564e5e3200eede844362bf465944db9d92c
-
SHA512
4cd1aa6c0c15264cf00feed59552e6bd1ce663af54d5fe27ac193d8af77abd23522938166ec0318482dbee6c78a6cc97f1e75a1ea148390da7c2aee6a3bca544
-
SSDEEP
49152:qvFt62XlaSFNWPjljiFa2RoUYIe5UU88DoGdWTHHB72eh2NTF:qv362XlaSFNWPjljiFXRoUYIIUU8E9
Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Quasar.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.MSIL.Quasar.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
quasar
1.4.1
Office04
85.219.48.223:6969
dd7993dd-3ead-48cf-ab1a-635718753276
-
encryption_key
DC9E2A3C163F32C37AC47FC14DF7F94F33786801
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
:)
-
subdirectory
SubDir
Targets
-
-
Target
HEUR-Trojan.MSIL.Quasar.gen-788c859458ab91850978e27a2591b564e5e3200eede844362bf465944db9d92c
-
Size
3.4MB
-
MD5
a585d666df5ca83eabcd06a4f0364523
-
SHA1
4f5d8d09aaaf33efda276c3f7ab9883eda146da6
-
SHA256
788c859458ab91850978e27a2591b564e5e3200eede844362bf465944db9d92c
-
SHA512
4cd1aa6c0c15264cf00feed59552e6bd1ce663af54d5fe27ac193d8af77abd23522938166ec0318482dbee6c78a6cc97f1e75a1ea148390da7c2aee6a3bca544
-
SSDEEP
49152:qvFt62XlaSFNWPjljiFa2RoUYIe5UU88DoGdWTHHB72eh2NTF:qv362XlaSFNWPjljiFXRoUYIIUU8E9
Score10/10-
Quasar payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects executables containing common artifacts observed in infostealers
-
Executes dropped EXE
-
Adds Run key to start application
-