General
-
Target
i0kg2848kgg.exe
-
Size
3.1MB
-
Sample
240426-ycff3saf77
-
MD5
f931165b2e8b1d1d24cd36493f708d7c
-
SHA1
88cb62105a1bf4e32d84723dd3caebc3882a6857
-
SHA256
ed3d436f78e3058932b45efcedcae77b37f84188b93a2ce960554def5f71a799
-
SHA512
f753b8e6db650883b4b5c71f8371ebebfb05a23369f995a2f1873cb9e545e003749139f49d2900d83c0522074ce0de62d175f7a7aadf5fb32ab2ea0a38de3bed
-
SSDEEP
49152:+vVt62XlaSFNWPjljiFa2RoUYIU8ChemzKfoGdzRTHHB72eh2NT:+vn62XlaSFNWPjljiFXRoUYIlChwj
Behavioral task
behavioral1
Sample
i0kg2848kgg.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
5.39.43.50:3647
b215ee18-0d25-4a0d-87bf-d8bc6fe3f832
-
encryption_key
27B814BF937E2D529835DABA7D5B0B82A424AB74
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows
-
subdirectory
SubDir
Targets
-
-
Target
i0kg2848kgg.exe
-
Size
3.1MB
-
MD5
f931165b2e8b1d1d24cd36493f708d7c
-
SHA1
88cb62105a1bf4e32d84723dd3caebc3882a6857
-
SHA256
ed3d436f78e3058932b45efcedcae77b37f84188b93a2ce960554def5f71a799
-
SHA512
f753b8e6db650883b4b5c71f8371ebebfb05a23369f995a2f1873cb9e545e003749139f49d2900d83c0522074ce0de62d175f7a7aadf5fb32ab2ea0a38de3bed
-
SSDEEP
49152:+vVt62XlaSFNWPjljiFa2RoUYIU8ChemzKfoGdzRTHHB72eh2NT:+vn62XlaSFNWPjljiFXRoUYIlChwj
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-