General
-
Target
Client-built.exe
-
Size
502KB
-
Sample
240727-xqftbsxape
-
MD5
fd8e1a617bc7a4bc6d62e32911c17042
-
SHA1
a222614719614f3d8f78e449e3e3d98051b6f315
-
SHA256
84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7
-
SHA512
44f1e24b6d6b747aea30e20409b719a583f0e385a12dcea5dbe37bed2b19842af08f149489f62c38d6a2a280bd85044ccd3384dbf22fba2b83a3f1b42989d2ee
-
SSDEEP
6144:tTEgdc0YKX7IxUpGREWEvOXiLzZTPrbb2cEwgb8F9Gj5r+QcTR38:tTEgdfYTxUnbx2gDwj5r+Qcd8
Malware Config
Extracted
quasar
1.4.0
Office04
me:4782
68.201.205.56:4782
4e19accb-bc80-45aa-917d-d5dca33ad8f0
-
encryption_key
3B611D04AAFAB02940B8BD5BC8618AF575293F55
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
2996
-
startup_key
system
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
502KB
-
MD5
fd8e1a617bc7a4bc6d62e32911c17042
-
SHA1
a222614719614f3d8f78e449e3e3d98051b6f315
-
SHA256
84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7
-
SHA512
44f1e24b6d6b747aea30e20409b719a583f0e385a12dcea5dbe37bed2b19842af08f149489f62c38d6a2a280bd85044ccd3384dbf22fba2b83a3f1b42989d2ee
-
SSDEEP
6144:tTEgdc0YKX7IxUpGREWEvOXiLzZTPrbb2cEwgb8F9Gj5r+QcTR38:tTEgdfYTxUnbx2gDwj5r+Qcd8
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-