General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240425-yvacsaea8s
-
MD5
c9732d408949b3d82ac9a957d399e0bb
-
SHA1
413c3d019088c910fd0bf9566c970bbe6757c33b
-
SHA256
733436d5bc6464c09757584b8609fa28898f2622412e55421ebdab550e02e4ea
-
SHA512
1f3d9b8cc4e04fdc6e56f687e7dd69a964581adf5f3f6b2ee03484d33d70f6487005046ff07cc2fbccb9be9ac80fc2c20906da07b4f0afcbb54581c42a9da45d
-
SSDEEP
49152:avUt62XlaSFNWPjljiFa2RoUYIocRJ6UbR3LoGdW01THHB72eh2NT:avI62XlaSFNWPjljiFXRoUYIocRJ6e
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
ZE:4782
911e182a-c76f-4c94-979c-4ba6b3b24941
-
encryption_key
EFF71D9D44DB5A6D9B14E191FC8CC16A1F4043B2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
c9732d408949b3d82ac9a957d399e0bb
-
SHA1
413c3d019088c910fd0bf9566c970bbe6757c33b
-
SHA256
733436d5bc6464c09757584b8609fa28898f2622412e55421ebdab550e02e4ea
-
SHA512
1f3d9b8cc4e04fdc6e56f687e7dd69a964581adf5f3f6b2ee03484d33d70f6487005046ff07cc2fbccb9be9ac80fc2c20906da07b4f0afcbb54581c42a9da45d
-
SSDEEP
49152:avUt62XlaSFNWPjljiFa2RoUYIocRJ6UbR3LoGdW01THHB72eh2NT:avI62XlaSFNWPjljiFXRoUYIocRJ6e
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-