General
-
Target
ratXD.exe
-
Size
3.1MB
-
Sample
240418-mrnv8aca4s
-
MD5
9c5f2f586e52a975593d11710685f846
-
SHA1
887006a6849b22cfbf85871e50ab33404097f654
-
SHA256
9259a4e7b71dc408f62faa9c6f7f73b5a906466dc9c751bfa8b23f641cc614f2
-
SHA512
c3fb61664de1248713b7c1a98d17b344a68d6a676841f174659565e043ec6aecc0c27bd4a47d815e0d19fd070054ff2ca57fb304878b284162a5b9142c2b38bf
-
SSDEEP
49152:avCI22SsaNYfdPBldt698dBcjHBY5VBxFUoGdD9THHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHBY5c
Behavioral task
behavioral1
Sample
ratXD.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
177.72.82.9:5678
62a700ff-4fdb-4af6-b871-ab8a290f0701
-
encryption_key
E0A41577673498A6E2FD27CB9AED2F6B83527072
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
quasar
-
reconnect_delay
3000
Targets
-
-
Target
ratXD.exe
-
Size
3.1MB
-
MD5
9c5f2f586e52a975593d11710685f846
-
SHA1
887006a6849b22cfbf85871e50ab33404097f654
-
SHA256
9259a4e7b71dc408f62faa9c6f7f73b5a906466dc9c751bfa8b23f641cc614f2
-
SHA512
c3fb61664de1248713b7c1a98d17b344a68d6a676841f174659565e043ec6aecc0c27bd4a47d815e0d19fd070054ff2ca57fb304878b284162a5b9142c2b38bf
-
SSDEEP
49152:avCI22SsaNYfdPBldt698dBcjHBY5VBxFUoGdD9THHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHBY5c
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-