General
-
Target
Client-built2.exe
-
Size
3.1MB
-
Sample
240602-b9v7gafd75
-
MD5
822eed302ff25105073dfb79ea894215
-
SHA1
2e5153d66fdc1837b387bf33a2292f6f2ec474d5
-
SHA256
397bd422af47cc0511d28b77593f1d768864ff7f76765fc778d9dc3115dc0f98
-
SHA512
fc89bc8d9ed1a7bdb4163222d59ec345a0e039c4fc0475467e91211e9a15bd5aa6436bf36062e1487fd6d3bad06b1aebea8e41360f559348c3c4cafcbfa16e2a
-
SSDEEP
49152:KvyI22SsaNYfdPBldt698dBcjHk5xNESE5k/i0LoGdLTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHaxE6
Behavioral task
behavioral1
Sample
Client-built2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Client-built2.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
quasar
1.4.1
dusan
192.168.178.20:4782
ded81f24-0e54-4985-a1fb-e180db45c27d
-
encryption_key
A81486939BB2FAD2A02EAF76B26242A2A9C6D91B
-
install_name
katani.exe
-
log_directory
Log
-
reconnect_delay
3000
-
startup_key
hacked by katani :)
-
subdirectory
download
Targets
-
-
Target
Client-built2.exe
-
Size
3.1MB
-
MD5
822eed302ff25105073dfb79ea894215
-
SHA1
2e5153d66fdc1837b387bf33a2292f6f2ec474d5
-
SHA256
397bd422af47cc0511d28b77593f1d768864ff7f76765fc778d9dc3115dc0f98
-
SHA512
fc89bc8d9ed1a7bdb4163222d59ec345a0e039c4fc0475467e91211e9a15bd5aa6436bf36062e1487fd6d3bad06b1aebea8e41360f559348c3c4cafcbfa16e2a
-
SSDEEP
49152:KvyI22SsaNYfdPBldt698dBcjHk5xNESE5k/i0LoGdLTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHaxE6
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Adds Run key to start application
-