General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240805-vqp1wswfne
-
MD5
66f3aa9e7180faae997c633fc1e03140
-
SHA1
90bc7af0951b32880d50dccba3a5cbb2eb97eec0
-
SHA256
41534fb7a8ececd82806a9f0ececd74695e1f2a0a086a3be0cc79999c30d07b3
-
SHA512
2c6884ec5e556d66dad7d95922f33a53ce15a01d6e869e8808638f03cde53e0c8ee845544302b88b7e9387b9de069ddbcdf506057dec78e318d0c45c532eda9d
-
SSDEEP
49152:OvEt62XlaSFNWPjljiFa2RoUYIMbsRJ63bR3LoGdETHHB72eh2NT:OvY62XlaSFNWPjljiFXRoUYIMoRJ6J
Malware Config
Extracted
quasar
1.4.1
Office04
172.27.16.1:4782
a71c5487-2d0f-4941-9dbe-f60cb458c959
-
encryption_key
5D1BA65461E2393B1E9F354F2BA00745F17296D8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
66f3aa9e7180faae997c633fc1e03140
-
SHA1
90bc7af0951b32880d50dccba3a5cbb2eb97eec0
-
SHA256
41534fb7a8ececd82806a9f0ececd74695e1f2a0a086a3be0cc79999c30d07b3
-
SHA512
2c6884ec5e556d66dad7d95922f33a53ce15a01d6e869e8808638f03cde53e0c8ee845544302b88b7e9387b9de069ddbcdf506057dec78e318d0c45c532eda9d
-
SSDEEP
49152:OvEt62XlaSFNWPjljiFa2RoUYIMbsRJ63bR3LoGdETHHB72eh2NT:OvY62XlaSFNWPjljiFXRoUYIMoRJ6J
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops file in System32 directory
-