General
-
Target
16f3ac9a4ca5183fec9a3a21fd3488e1.exe
-
Size
348KB
-
Sample
240606-ww5tzahg6z
-
MD5
16f3ac9a4ca5183fec9a3a21fd3488e1
-
SHA1
ea6baf86951a97d224f25a893ecd00a156e1a993
-
SHA256
abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62
-
SHA512
8ec7a8f684c0318980c6c5b42932c4ef42734199ad6abef22d53b0ba12f14a34012f9b269d064fe60c943693a375fd49f66b8e568d061b277a0ee3de0672d586
-
SSDEEP
6144:ezNHXf500Mb5t5eewCbYTio7QiWPpQR63ejZEe:wd50HtkRzFQ7PO6OjZEe
Behavioral task
behavioral1
Sample
16f3ac9a4ca5183fec9a3a21fd3488e1.exe
Resource
win7-20240508-en
Malware Config
Extracted
quasar
1.3.0.0
Office04
39.105.31.193:50050
QSR_MUTEX_H0vcBfjQRUzioI2ltj
-
encryption_key
SAA4yJPZ67wykJkTFy3u
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
16f3ac9a4ca5183fec9a3a21fd3488e1.exe
-
Size
348KB
-
MD5
16f3ac9a4ca5183fec9a3a21fd3488e1
-
SHA1
ea6baf86951a97d224f25a893ecd00a156e1a993
-
SHA256
abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62
-
SHA512
8ec7a8f684c0318980c6c5b42932c4ef42734199ad6abef22d53b0ba12f14a34012f9b269d064fe60c943693a375fd49f66b8e568d061b277a0ee3de0672d586
-
SSDEEP
6144:ezNHXf500Mb5t5eewCbYTio7QiWPpQR63ejZEe:wd50HtkRzFQ7PO6OjZEe
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-