General
-
Target
Vantage.exe
-
Size
3.1MB
-
Sample
240607-ger48abe57
-
MD5
386a61daf60783f7139760724e97531c
-
SHA1
20109395f6b716c5b438db300161e9226807f166
-
SHA256
4ae75d2f7d7ffa3bf630dfc94151fdeb7dbb8addb1421190c81a7cd9546394af
-
SHA512
3ae21351d74e2c645363359ca56df92fcd9a6fa863e3110542b3daa04414f33a51ea0c3fa4cfa2d2f3473d59c590f2c73c8d9c579eb774687b9a4b91bcdd53df
-
SSDEEP
49152:2vyI22SsaNYfdPBldt698dBcjHwme3mznUoGd0THHB72eh2NT:2vf22SsaNYfdPBldt6+dBcjHwme/
Malware Config
Extracted
quasar
1.4.1
Office04
g13r31f3f-22314.portmap.host:22314
520be7f0-758b-4fd1-9fb7-091b276a836c
-
encryption_key
22E1CEDD499CF960E04C4BFAF0A883FF357475C7
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SteamVAC
-
subdirectory
SubDir
Targets
-
-
Target
Vantage.exe
-
Size
3.1MB
-
MD5
386a61daf60783f7139760724e97531c
-
SHA1
20109395f6b716c5b438db300161e9226807f166
-
SHA256
4ae75d2f7d7ffa3bf630dfc94151fdeb7dbb8addb1421190c81a7cd9546394af
-
SHA512
3ae21351d74e2c645363359ca56df92fcd9a6fa863e3110542b3daa04414f33a51ea0c3fa4cfa2d2f3473d59c590f2c73c8d9c579eb774687b9a4b91bcdd53df
-
SSDEEP
49152:2vyI22SsaNYfdPBldt698dBcjHwme3mznUoGd0THHB72eh2NT:2vf22SsaNYfdPBldt6+dBcjHwme/
-
Quasar payload
-
Executes dropped EXE
-