General
-
Target
Solara.exe
-
Size
3.1MB
-
Sample
240520-mpdbpsfg28
-
MD5
547f1ce058f078b8a71b2480908efc86
-
SHA1
8672c0cb7fadabddac6b785dc6a3b6ca801e43f8
-
SHA256
515cf47c5e3294404633bb98b2f50b615af7ab0cf2c3ff1f6675d5d59911e45d
-
SHA512
22a47ed6393c3102c78ae259954c3fef3b2ea94ab721c3d2184f9775102d22f81d6893b677e1cd9b10d7e4533ce99a3fc9efd28f2e0c203c2aefa52574bd64c7
-
SSDEEP
49152:DvnI22SsaNYfdPBldt698dBcjHV7xe1v1LoGlMTHHB72eh2NT:DvI22SsaNYfdPBldt6+dBcjHV7xS
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.178.104:4782
e891c020-455f-4321-953c-920a855946ba
-
encryption_key
183636CA2E363ADC2283216B0F563CCDFFEDBD78
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Solara.exe
-
Size
3.1MB
-
MD5
547f1ce058f078b8a71b2480908efc86
-
SHA1
8672c0cb7fadabddac6b785dc6a3b6ca801e43f8
-
SHA256
515cf47c5e3294404633bb98b2f50b615af7ab0cf2c3ff1f6675d5d59911e45d
-
SHA512
22a47ed6393c3102c78ae259954c3fef3b2ea94ab721c3d2184f9775102d22f81d6893b677e1cd9b10d7e4533ce99a3fc9efd28f2e0c203c2aefa52574bd64c7
-
SSDEEP
49152:DvnI22SsaNYfdPBldt698dBcjHV7xe1v1LoGlMTHHB72eh2NT:DvI22SsaNYfdPBldt6+dBcjHV7xS
-
Quasar payload
-
Executes dropped EXE
-