General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240422-gwkrgagg3x
-
MD5
41de983b173011ea0f81bc18257927ea
-
SHA1
48b40eadc6eca603b8adc15bc38a0b5b9450e56a
-
SHA256
1db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
-
SHA512
4efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525
-
SSDEEP
49152:yvyI22SsaNYfdPBldt698dBcjHBK8wDMfVEoGdATHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjHBK8wT
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.40.129:4782
19c3bb2c-1a75-4589-b738-25f9f15ec087
-
encryption_key
9BD7B5AD8335EC9A1AB45A1EB5FC9CA0CBA10236
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
41de983b173011ea0f81bc18257927ea
-
SHA1
48b40eadc6eca603b8adc15bc38a0b5b9450e56a
-
SHA256
1db7148b47d7219aa4587138b491a4b4bb41c7d95bfc0bdd152fdd6f1d774edb
-
SHA512
4efe78911125a02dea2a1e5112ae5869773b95862a104c9a97b4953a9a723898a56638f25cbb8508219896ffee9d5ae5d15d9dd1eb8790c2f28bfea1209a3525
-
SSDEEP
49152:yvyI22SsaNYfdPBldt698dBcjHBK8wDMfVEoGdATHHB72eh2NT:yvf22SsaNYfdPBldt6+dBcjHBK8wT
-
Quasar payload
-
Executes dropped EXE
-