General
-
Target
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
Size
348KB
-
Sample
240603-vrexbaee67
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
Behavioral task
behavioral1
Sample
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Resource
win7-20231129-en
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_q1SPcFNLEQ1FIcq9Po
-
encryption_key
qQYEXzkyhZKvRSzcxALx
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
Size
348KB
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-