General
-
Target
Client-built.exe
-
Size
502KB
-
Sample
240727-xpw4xsxand
-
MD5
b11cfa8acb693b17695f12c8c864af68
-
SHA1
6ea82c6078f49894329e62636a3662aef379bb6c
-
SHA256
a61f6f2d56a993cb1e1aaf9f83efb9b3bc83df0d8f8b8f142dc36e2f7d66b27b
-
SHA512
86b7ea4110e59f2089aa43506b62195ab79aae90f86f15f60c2832e5dccd6b16b9724d7e733e7eb467cd971555dbc7cdc7cba85c9592fb82475483d60681a2b6
-
SSDEEP
6144:cTEgdc0YyXiPUEXaR8AN85qmqKQVXzzqqncEgDb8UX0PoGz89cycTR3g:cTEgdfYzUEZqdwfEgeccycdg
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.0
Office04
me:4782
4e19accb-bc80-45aa-917d-d5dca33ad8f0
-
encryption_key
3B611D04AAFAB02940B8BD5BC8618AF575293F55
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
2996
-
startup_key
system
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
502KB
-
MD5
b11cfa8acb693b17695f12c8c864af68
-
SHA1
6ea82c6078f49894329e62636a3662aef379bb6c
-
SHA256
a61f6f2d56a993cb1e1aaf9f83efb9b3bc83df0d8f8b8f142dc36e2f7d66b27b
-
SHA512
86b7ea4110e59f2089aa43506b62195ab79aae90f86f15f60c2832e5dccd6b16b9724d7e733e7eb467cd971555dbc7cdc7cba85c9592fb82475483d60681a2b6
-
SSDEEP
6144:cTEgdc0YyXiPUEXaR8AN85qmqKQVXzzqqncEgDb8UX0PoGz89cycTR3g:cTEgdfYzUEZqdwfEgeccycdg
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-