General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240805-2dhjlsthrc
-
MD5
7fbad184eb995a66ad7f38f0b7a70998
-
SHA1
1a66af584043370bbbbc55617fbcb6c47f9d613d
-
SHA256
02d99fc557a0828cc67be76a9e8c84cd83153a278f454d24c8a6c171bee5287d
-
SHA512
b2c926aaf5754a3e1856b4f0a77d7fbcd076813c2d9d53dbf88017a0b5610d4891ab448c92dedc4e4ebe46ae2b218ded71364826869691e6eb5d5d8b65e6106f
-
SSDEEP
49152:+kzwH0050UNS+/TsXu17x4wpJeOu4yDz8qYvkO2eTJ0THHB72eh2NTd8:+k1050gS+/TsXu17x4wpJ/guvN
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240708-en
Malware Config
Extracted
quasar
1.4.1
Office04
147.185.221.20:18563
147.185.221.20:9835
c2e1b18a-ce93-436d-ad8b-21bf89015e19
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
7fbad184eb995a66ad7f38f0b7a70998
-
SHA1
1a66af584043370bbbbc55617fbcb6c47f9d613d
-
SHA256
02d99fc557a0828cc67be76a9e8c84cd83153a278f454d24c8a6c171bee5287d
-
SHA512
b2c926aaf5754a3e1856b4f0a77d7fbcd076813c2d9d53dbf88017a0b5610d4891ab448c92dedc4e4ebe46ae2b218ded71364826869691e6eb5d5d8b65e6106f
-
SSDEEP
49152:+kzwH0050UNS+/TsXu17x4wpJeOu4yDz8qYvkO2eTJ0THHB72eh2NTd8:+k1050gS+/TsXu17x4wpJ/guvN
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-