General
-
Target
Hello.zip
-
Size
1.2MB
-
Sample
240603-q99gesab48
-
MD5
06c9f31b75092e470cbbf178827d9e7c
-
SHA1
5025dbfac6a48ca594973f43c801ddc47627c236
-
SHA256
1e8520858b228d7d7e60985b90089e0223a69c5118a7029b10658177dcb4709b
-
SHA512
9dcd719b323cadba6f8e624adf8b2506d777f7e0638a807bb8cb787650b79822057588fb02e835d811e7849ac1fceeb0cf14243c7823979ab1e7309bb05826dc
-
SSDEEP
24576:84pV5+PxnMFVd6JR72YmuptCCn1Q8LmhHNJeB49SXIs5D+d68gyMBnF5v6G:84f5+Zsd6nZpn1QFeyIVD+WBFFL
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20231129-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.104:4782
192.168.1.104:50133
127.0.0.1:6000
DESKTOP-9IMIHQU:49736
127.0.0.1:4782
127.0.07.1:50133
192.168.1.104:6000
03bae1e9-f5dc-4e0e-94fb-62a44e846020
-
encryption_key
1BDF94B25EA282E8D3B48C8D6810CDDC133AFA4C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
feb24955d3504654b50393efdafde20d
-
SHA1
3e43172200820307c71d2885a94d4f40efd5cda7
-
SHA256
6f732f4a61ca68e185972687c1ecd6a2fed2b25bea11dd81bb9c5d8f0e471bce
-
SHA512
1547189a9a14f4fe7313d2bf07218c52b88128ca66d704ce0cb1ad1f529af6c87192c2f2f639f00718ed21cab5b0ebb14416e24c9b77c129ae54026de8f9b1fd
-
SSDEEP
49152:Uv0iiN2tPa2vpJPylxhhC25D/Wv1zZLljFuvJmYoGdk/4THHB72eh2NT:Uv/q2tPa2vpJPylxhhz5D/WNjFAU
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-