General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240602-1a1eksfe6z
-
MD5
dc3f5eebf8ab3dd6fef8b51610d2c356
-
SHA1
0847d42da980bafd989804386b0889c1ceb5a869
-
SHA256
3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
-
SHA512
03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
-
SSDEEP
49152:bvCI22SsaNYfdPBldt698dBcjHZKxNESE9k/ikLoGdwTHHB72eh2NT:bvP22SsaNYfdPBldt6+dBcjHAxgq
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
Malware Config
Extracted
quasar
1.4.1
RAT - fake incognito
192.168.4.30:4782
d94dce9f-b2a7-4e68-b727-6888151a6b4e
-
encryption_key
40B0884053AA1A1D9985C8E042F5C321462F78A6
-
install_name
Incognito.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Incognito
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
dc3f5eebf8ab3dd6fef8b51610d2c356
-
SHA1
0847d42da980bafd989804386b0889c1ceb5a869
-
SHA256
3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
-
SHA512
03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
-
SSDEEP
49152:bvCI22SsaNYfdPBldt698dBcjHZKxNESE9k/ikLoGdwTHHB72eh2NT:bvP22SsaNYfdPBldt6+dBcjHAxgq
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-