General
-
Target
Client-built.exe
-
Size
502KB
-
Sample
240727-xnjr7sxakg
-
MD5
ba584f5d3b9cb7703256f08853a49f3e
-
SHA1
59623f053627d043b833d66d2b6e858bae0a24ba
-
SHA256
39845201dd846084359861286b4a612129c05c23f0d2a5bfc0eaf758b2398a72
-
SHA512
13747f7b53918145beb4587056937f067f1b81a6a3a05508d2d311fd016d9b9fcb3a880073d2cb774609702af0e6f4e4de7ef6a24a06376cc6f55d11726d2664
-
SSDEEP
6144:ITEgdc0YyXiPUEXaR8AdJ94borFzcDcSLNwcE5tb8FPVTar3Vlz0BgcTR38:ITEgdfYzUEIzlEdqpSk3V50Bgcd8
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
quasar
1.4.0
Office04
me:4782
4e19accb-bc80-45aa-917d-d5dca33ad8f0
-
encryption_key
3B611D04AAFAB02940B8BD5BC8618AF575293F55
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
2996
-
startup_key
system
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
502KB
-
MD5
ba584f5d3b9cb7703256f08853a49f3e
-
SHA1
59623f053627d043b833d66d2b6e858bae0a24ba
-
SHA256
39845201dd846084359861286b4a612129c05c23f0d2a5bfc0eaf758b2398a72
-
SHA512
13747f7b53918145beb4587056937f067f1b81a6a3a05508d2d311fd016d9b9fcb3a880073d2cb774609702af0e6f4e4de7ef6a24a06376cc6f55d11726d2664
-
SSDEEP
6144:ITEgdc0YyXiPUEXaR8AdJ94borFzcDcSLNwcE5tb8FPVTar3Vlz0BgcTR38:ITEgdfYzUEIzlEdqpSk3V50Bgcd8
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-