General
-
Target
aa.exe
-
Size
3.1MB
-
Sample
240418-rmdlxafd75
-
MD5
a1b18584a5906f5be41db7dd83325caa
-
SHA1
749e349a70fb0a2778900fceb15ff7f3ed033196
-
SHA256
ef2c6cf5a0ba1b81ab22164b7820f49761de4f6feb8fa4e5c64a1bfad369cc74
-
SHA512
037e7b94ccea547a113304aa73fb940401c18a8e1d3df5681a191b0f9292769419f48bf8fe1f6f69534f320f34fabac638735d2e3ea2ff12039518193dca4ede
-
SSDEEP
49152:Wv7I22SsaNYfdPBldt698dBcjHqHfkfXvjjLoGlvTHHB72eh2NT:WvE22SsaNYfdPBldt6+dBcjHLfj
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.254.152:4782
180.190.63.111:8080
37c3d2aa-6a36-4ee8-a4be-f1c3187fbd03
-
encryption_key
E9EE5B51F341491A9CE8837BE89BB18191B86C1E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
python
-
subdirectory
SubDir
Targets
-
-
Target
aa.exe
-
Size
3.1MB
-
MD5
a1b18584a5906f5be41db7dd83325caa
-
SHA1
749e349a70fb0a2778900fceb15ff7f3ed033196
-
SHA256
ef2c6cf5a0ba1b81ab22164b7820f49761de4f6feb8fa4e5c64a1bfad369cc74
-
SHA512
037e7b94ccea547a113304aa73fb940401c18a8e1d3df5681a191b0f9292769419f48bf8fe1f6f69534f320f34fabac638735d2e3ea2ff12039518193dca4ede
-
SSDEEP
49152:Wv7I22SsaNYfdPBldt698dBcjHqHfkfXvjjLoGlvTHHB72eh2NT:WvE22SsaNYfdPBldt6+dBcjHLfj
-
Quasar payload
-
Executes dropped EXE
-