General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240723-qgnz1svbnf
-
MD5
39bf77938932902a452a7f79e3a392d5
-
SHA1
6fa01f25e1211ebefbbe9a4cccef4223cfbba1ea
-
SHA256
07d3041cc1e083636c50da63eba0582f2a3b169b26a6bc3c155e90c126c6c3a0
-
SHA512
5805d811f47ed1f423d9043a6652d0f9c52e2a9e56d156da4d24061d8ab840220a4059e094218a421f5e2b5d66234e3a83c6fe4962b5dde3b2b7a03e147ad0dd
-
SSDEEP
49152:uvkt62XlaSFNWPjljiFa2RoUYI9sn85BbRULoGdVzSTHHB72eh2NT:uv462XlaSFNWPjljiFXRoUYI9sn85i
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.4:4782
7e7eefb0-bbcf-4b86-acd2-8a3675af71f2
-
encryption_key
850E5D08EE2F98145C3742B9BDCCD637E6DD2097
-
install_name
taskhost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
taskhost
-
subdirectory
SKR
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
39bf77938932902a452a7f79e3a392d5
-
SHA1
6fa01f25e1211ebefbbe9a4cccef4223cfbba1ea
-
SHA256
07d3041cc1e083636c50da63eba0582f2a3b169b26a6bc3c155e90c126c6c3a0
-
SHA512
5805d811f47ed1f423d9043a6652d0f9c52e2a9e56d156da4d24061d8ab840220a4059e094218a421f5e2b5d66234e3a83c6fe4962b5dde3b2b7a03e147ad0dd
-
SSDEEP
49152:uvkt62XlaSFNWPjljiFa2RoUYI9sn85BbRULoGdVzSTHHB72eh2NT:uv462XlaSFNWPjljiFXRoUYI9sn85i
-
Quasar payload
-
Executes dropped EXE
-