General
-
Target
Admin2z.exe
-
Size
3.4MB
-
Sample
240427-pxs38sag35
-
MD5
c8cddebd9663448a50be915c36564714
-
SHA1
1a1c6390d03c09d94eb1618be8afcc25e4559086
-
SHA256
55f65d41b335b600d90741a4b54419e9994f3357aa0ab58caede30a2c91f1d92
-
SHA512
9e619c24b38e413b8a8813363499d45b7e0de8b2f0c650fb9d1f0c269b4cbef60e8fa87b57ddcdb97ead83798fed14f290591641bc9f8c670e775ed69665d005
-
SSDEEP
98304:fvY62XlaSFNWPjljiFXRoUYIjhRJ6DDx:XQZYsC
Malware Config
Extracted
quasar
1.4.1
Office04
gaykami.zapto.org:4782
fd070244-4e4f-464f-bf66-b0519c62cf67
-
encryption_key
D408429A8F1C644E0A5D5AD709BD41BEADE3C3F6
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Admin2z.exe
-
Size
3.4MB
-
MD5
c8cddebd9663448a50be915c36564714
-
SHA1
1a1c6390d03c09d94eb1618be8afcc25e4559086
-
SHA256
55f65d41b335b600d90741a4b54419e9994f3357aa0ab58caede30a2c91f1d92
-
SHA512
9e619c24b38e413b8a8813363499d45b7e0de8b2f0c650fb9d1f0c269b4cbef60e8fa87b57ddcdb97ead83798fed14f290591641bc9f8c670e775ed69665d005
-
SSDEEP
98304:fvY62XlaSFNWPjljiFXRoUYIjhRJ6DDx:XQZYsC
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-