General
-
Target
Loader.exe
-
Size
286KB
-
Sample
240602-xphxasbe5z
-
MD5
4e47b6257fa7e2221df20e6d9f7fc47a
-
SHA1
7d6116a578f51d87cad1efe9e5971c412eb769a9
-
SHA256
eeddf97a4c02250bdff26feba1085ff30277d2f71054cd32e8796554fffb23e6
-
SHA512
6e5e3d2e865fa2c2d229c70f7a10a3821316b91b7daa66ecdfea9dcc7275d30da56f56a90eb64fdbe603e0aa50d5d797c40a4877e48ab0328a6d6ebc06ddd532
-
SSDEEP
6144:OhVZx2zU1Ypil1TQxqhzu4nkhdVwbjJ1ybkWrrpo:ExT1tY4Idc1ybkWho
Malware Config
Extracted
quasar
1.4.0.0
Office
espinyskibidi-40205.portmap.host:40205
CdrjrrWbtRopP1ic7E
-
encryption_key
P2ctPN6uGReD4W1dEypm
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Client
-
subdirectory
Microsoft
Targets
-
-
Target
Loader.exe
-
Size
286KB
-
MD5
4e47b6257fa7e2221df20e6d9f7fc47a
-
SHA1
7d6116a578f51d87cad1efe9e5971c412eb769a9
-
SHA256
eeddf97a4c02250bdff26feba1085ff30277d2f71054cd32e8796554fffb23e6
-
SHA512
6e5e3d2e865fa2c2d229c70f7a10a3821316b91b7daa66ecdfea9dcc7275d30da56f56a90eb64fdbe603e0aa50d5d797c40a4877e48ab0328a6d6ebc06ddd532
-
SSDEEP
6144:OhVZx2zU1Ypil1TQxqhzu4nkhdVwbjJ1ybkWrrpo:ExT1tY4Idc1ybkWho
-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-