General
-
Target
fef41f0e605a109f64d8078ad0bb3813b39f562a90c63449120bae59be131284.exe
-
Size
3.1MB
-
Sample
240722-wdak4szdrm
-
MD5
a04d89e5a98ecb336015cbd707cefd6d
-
SHA1
1aa18dee96398c1b5f0dabba5af33ebbb3b1361f
-
SHA256
fef41f0e605a109f64d8078ad0bb3813b39f562a90c63449120bae59be131284
-
SHA512
ddd9a73d4b08f3429623b5328ab8aadf1469317ec6a060a115c9bd370011fe5f26a1f0d2a664c20616c631a8b7dda8ce0bdb7a3cf2d35a6fdc76b9faaa0afeda
-
SSDEEP
49152:pvHI22SsaNYfdPBldt698dBcjHtBOxNESE9k/ic7oGdSeTHHB72eh2NT:pvo22SsaNYfdPBldt6+dBcjHPOxs+
Behavioral task
behavioral1
Sample
fef41f0e605a109f64d8078ad0bb3813b39f562a90c63449120bae59be131284.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
Office04
85.28.47.123:4782
37891bd4-27a1-4fb6-aecb-ba06bb063e71
-
encryption_key
7970C2029EDBB83E6BD65073BE18684AC9FF3F48
-
install_name
KR6nDu9fLhop1bFe.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
defender.proces
-
subdirectory
SubDir
Targets
-
-
Target
fef41f0e605a109f64d8078ad0bb3813b39f562a90c63449120bae59be131284.exe
-
Size
3.1MB
-
MD5
a04d89e5a98ecb336015cbd707cefd6d
-
SHA1
1aa18dee96398c1b5f0dabba5af33ebbb3b1361f
-
SHA256
fef41f0e605a109f64d8078ad0bb3813b39f562a90c63449120bae59be131284
-
SHA512
ddd9a73d4b08f3429623b5328ab8aadf1469317ec6a060a115c9bd370011fe5f26a1f0d2a664c20616c631a8b7dda8ce0bdb7a3cf2d35a6fdc76b9faaa0afeda
-
SSDEEP
49152:pvHI22SsaNYfdPBldt698dBcjHtBOxNESE9k/ic7oGdSeTHHB72eh2NT:pvo22SsaNYfdPBldt6+dBcjHPOxs+
-
Quasar payload
-
Executes dropped EXE
-