General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240417-ss5g9adg93
-
MD5
eb8790c82d5096b84022449c2298c62a
-
SHA1
12030a6f4988fb744328bc1963c7017207e40276
-
SHA256
5bc8c6aa7ccb11de2b19cabc08c096025da18e7898c5e8227ef109c266820f82
-
SHA512
d4d7ac397e023e6c08dfd6681e802d4c52d56a45a4e66acd53bc0138d3ed45f3930ef0d90cdeaafcf478d08ecab28cae61ffe5c571fa4c37be39497f16891464
-
SSDEEP
49152:WvIt62XlaSFNWPjljiFa2RoUYIruW+dpfYoGdizZDTHHB72eh2NT:WvE62XlaSFNWPjljiFXRoUYI6W9
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.240:4782
fcdb4cfb-dc40-4f51-b2c7-f723b5404e35
-
encryption_key
1074AFFC8845D6B93DCAD37B9C170AE9CD58D08A
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windowsstartup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
eb8790c82d5096b84022449c2298c62a
-
SHA1
12030a6f4988fb744328bc1963c7017207e40276
-
SHA256
5bc8c6aa7ccb11de2b19cabc08c096025da18e7898c5e8227ef109c266820f82
-
SHA512
d4d7ac397e023e6c08dfd6681e802d4c52d56a45a4e66acd53bc0138d3ed45f3930ef0d90cdeaafcf478d08ecab28cae61ffe5c571fa4c37be39497f16891464
-
SSDEEP
49152:WvIt62XlaSFNWPjljiFa2RoUYIruW+dpfYoGdizZDTHHB72eh2NT:WvE62XlaSFNWPjljiFXRoUYI6W9
-
Quasar payload
-
Executes dropped EXE
-