General
-
Target
probably a virus.exe
-
Size
3.1MB
-
Sample
240727-q3bxkssbnr
-
MD5
4fa7681cbbb5c8490bc5a3d0443243a1
-
SHA1
dd048b789a588327a7d0f25dadd26b76be20e261
-
SHA256
ab29a6c24ed11ed525a88bea16c94a242adce92c8693ff58db29d3b30b9734cc
-
SHA512
0806a0f82766340988df26c0069c1b9f02c9b385d70bfc03d642a5cdb56248824045e78c7e31f6862d698ddde5faefece0e9bf57e1a0a41c0c69e70912872200
-
SSDEEP
49152:rv6I22SsaNYfdPBldt698dBcjHtxcEjIJk/JtLoGd36THHB72eh2NT:rv322SsaNYfdPBldt6+dBcjHtxrl
Behavioral task
behavioral1
Sample
probably a virus.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.153:4782
ff7b12dd-dcb4-433b-b12e-5af421c67569
-
encryption_key
435FB1E709EE069900BC9EC6FC3D4B7E80A22952
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
probably a virus.exe
-
Size
3.1MB
-
MD5
4fa7681cbbb5c8490bc5a3d0443243a1
-
SHA1
dd048b789a588327a7d0f25dadd26b76be20e261
-
SHA256
ab29a6c24ed11ed525a88bea16c94a242adce92c8693ff58db29d3b30b9734cc
-
SHA512
0806a0f82766340988df26c0069c1b9f02c9b385d70bfc03d642a5cdb56248824045e78c7e31f6862d698ddde5faefece0e9bf57e1a0a41c0c69e70912872200
-
SSDEEP
49152:rv6I22SsaNYfdPBldt698dBcjHtxcEjIJk/JtLoGd36THHB72eh2NT:rv322SsaNYfdPBldt6+dBcjHtxrl
-
Quasar payload
-
Executes dropped EXE
-