General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240724-dmqpksvdpj
-
MD5
82ba7526f0ba0ee9fd92c10b2aafd355
-
SHA1
b53cfc38809e7e439c740b6168de81ece2310e49
-
SHA256
cec358561bbae4d72b2665c1b5fd48cfee3f1fed503efb63fe1f9ce70fa7936a
-
SHA512
a46d293aaf128682787f9bcc3754b18ce9b2870b9a781695bb7b26183002a2c501c6c04cffbf56c64d1c346d353018eed3fcb09f744509027466aa5e272dc429
-
SSDEEP
49152:Cvkt62XlaSFNWPjljiFa2RoUYILWRJ6rbR3LoGdg+THHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYILWRJ69Q
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240708-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.4:4782
7e7eefb0-bbcf-4b86-acd2-8a3675af71f2
-
encryption_key
850E5D08EE2F98145C3742B9BDCCD637E6DD2097
-
install_name
taskhost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
taskhost
-
subdirectory
SKR
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
82ba7526f0ba0ee9fd92c10b2aafd355
-
SHA1
b53cfc38809e7e439c740b6168de81ece2310e49
-
SHA256
cec358561bbae4d72b2665c1b5fd48cfee3f1fed503efb63fe1f9ce70fa7936a
-
SHA512
a46d293aaf128682787f9bcc3754b18ce9b2870b9a781695bb7b26183002a2c501c6c04cffbf56c64d1c346d353018eed3fcb09f744509027466aa5e272dc429
-
SSDEEP
49152:Cvkt62XlaSFNWPjljiFa2RoUYILWRJ6rbR3LoGdg+THHB72eh2NT:Cv462XlaSFNWPjljiFXRoUYILWRJ69Q
-
Quasar payload
-
Executes dropped EXE
-