General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240420-1md24sbd2s
-
MD5
4d037c46eaf6b2e5ae5db85ef045c0d1
-
SHA1
7bc3b6647192157a2cc4894f4c58365d9932a2cf
-
SHA256
c18eadfdcee5050757e12c48fc44db31612863eb37db0fbc2dcbaad7ff5ae821
-
SHA512
163d60321af8d3da76d10ea550b4c792dd0b6a18abe603ab049043246b2136fb2543f8089e3e5d3fbd6e6bfcf1786f4f7b8a96cb28e353cefbe1a2553e753ab3
-
SSDEEP
49152:8vGlL26AaNeWgPhlmVqvMQ7XSKGSRJ6pbR3LoGd+THHB72eh2NTf:8vGL26AaNeWgPhlmVqkQ7XSKGSRJ6rP
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240215-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.154:4782
ba502bba-c1c8-4a0b-95e6-4b1a3d5f551e
-
encryption_key
7195172212FD0C3E2300AE89FC3318C365A0CFF8
-
install_name
window security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
window security
-
subdirectory
C:\Windows\System32
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4d037c46eaf6b2e5ae5db85ef045c0d1
-
SHA1
7bc3b6647192157a2cc4894f4c58365d9932a2cf
-
SHA256
c18eadfdcee5050757e12c48fc44db31612863eb37db0fbc2dcbaad7ff5ae821
-
SHA512
163d60321af8d3da76d10ea550b4c792dd0b6a18abe603ab049043246b2136fb2543f8089e3e5d3fbd6e6bfcf1786f4f7b8a96cb28e353cefbe1a2553e753ab3
-
SSDEEP
49152:8vGlL26AaNeWgPhlmVqvMQ7XSKGSRJ6pbR3LoGd+THHB72eh2NTf:8vGL26AaNeWgPhlmVqkQ7XSKGSRJ6rP
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-