General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240605-z8tt1saf79
-
MD5
e46a4d586b41c48125c7f5f44e5f23e2
-
SHA1
b0ea55d5932426e0722167989691f11e08980ee0
-
SHA256
8a7cfe4a79b49501f486288fe3c87138305119b04f126a8a9e8408f3d8e3771c
-
SHA512
68c999533b8e3e5f2ede4f1b69838c99530b67f6f3da9ebd3c5641de72bcbfeae0b06e52811c602fbf52a85a4726109e8aab3d97fd1181dce34548106b12978b
-
SSDEEP
49152:jvpG42pda6D+/PjlLOlg6yQipVy8vE780k/mkEoGdiyTHHB72eh2NT:jvY42pda6D+/PjlLOlZyQipVy8Gv
Malware Config
Extracted
quasar
1.4.1
Office04
10.9.33.1:25377
SteveLean-47385.portmap.host:47385
603e73f4-1a5c-4a9d-96e3-7ee1f44390dd
-
encryption_key
5C96F3FC23C24141669D950745FC3357502CE24B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
e46a4d586b41c48125c7f5f44e5f23e2
-
SHA1
b0ea55d5932426e0722167989691f11e08980ee0
-
SHA256
8a7cfe4a79b49501f486288fe3c87138305119b04f126a8a9e8408f3d8e3771c
-
SHA512
68c999533b8e3e5f2ede4f1b69838c99530b67f6f3da9ebd3c5641de72bcbfeae0b06e52811c602fbf52a85a4726109e8aab3d97fd1181dce34548106b12978b
-
SSDEEP
49152:jvpG42pda6D+/PjlLOlg6yQipVy8vE780k/mkEoGdiyTHHB72eh2NT:jvY42pda6D+/PjlLOlZyQipVy8Gv
-
Quasar payload
-
Executes dropped EXE
-