General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240418-rbnyhagb7t
-
MD5
af13ce84d2a5ee2ab7854af2d6571ab1
-
SHA1
bf082b48f3bd45f8e6c55a7e897f5171181fad61
-
SHA256
30369ff4ed77a2cf2fd35a32c876a222cca094e7db7344051dc881e982908e95
-
SHA512
e501e34e108a99a8a82560b20baccdd3746f5713a0fbaa37a209ff1daacf6637022c5bfd35ff25efdc9adbf7ddf72e7882cf300d076f1ab0886174437e801d56
-
SSDEEP
49152:HvnI22SsaNYfdPBldt698dBcjHoRxNESEQk/inLoGdTTHHB72eh2NT:HvI22SsaNYfdPBldt6+dBcjH2xjL
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.254.152:4782
37c3d2aa-6a36-4ee8-a4be-f1c3187fbd03
-
encryption_key
E9EE5B51F341491A9CE8837BE89BB18191B86C1E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
af13ce84d2a5ee2ab7854af2d6571ab1
-
SHA1
bf082b48f3bd45f8e6c55a7e897f5171181fad61
-
SHA256
30369ff4ed77a2cf2fd35a32c876a222cca094e7db7344051dc881e982908e95
-
SHA512
e501e34e108a99a8a82560b20baccdd3746f5713a0fbaa37a209ff1daacf6637022c5bfd35ff25efdc9adbf7ddf72e7882cf300d076f1ab0886174437e801d56
-
SSDEEP
49152:HvnI22SsaNYfdPBldt698dBcjHoRxNESEQk/inLoGdTTHHB72eh2NT:HvI22SsaNYfdPBldt6+dBcjH2xjL
-
Quasar payload
-
Executes dropped EXE
-