General
-
Target
2024-08-06_732b03ac502db49cef973bd07b2bf87a_icedid_poet-rat_quasar-rat_xrat
-
Size
4.8MB
-
Sample
240806-a31b6sxfkh
-
MD5
732b03ac502db49cef973bd07b2bf87a
-
SHA1
ea356a1acfc1dfbf117a4bbbfbd57bcdc670fad1
-
SHA256
a6099c491eee80fe035edbaa41ca5efedd1fedecb115bcac9e5e549d63ce2f1e
-
SHA512
d3a114e9c2eeee1b798f5e588d49d27650bdb9857bd9e38d8051f69fee00f5733e879acbecc891a282ccb727d62a111a4fe24d4989bc17fef0e9ee9c798ccbbb
-
SSDEEP
98304:ECHmauGx7Pvr22SsaNYfdPBldt6+dBcjHtKRJ6B1IbzZjIbzZY:YaM7jGIa6K
Behavioral task
behavioral1
Sample
2024-08-06_732b03ac502db49cef973bd07b2bf87a_icedid_poet-rat_quasar-rat_xrat.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
Office04
mx5.deitie.asia:4495
ebbf737a-dddd-43dd-9b0a-74831302455d
-
encryption_key
F8516D89A1DFD78BD8FF575BBC3AE828B47FF0E1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
2024-08-06_732b03ac502db49cef973bd07b2bf87a_icedid_poet-rat_quasar-rat_xrat
-
Size
4.8MB
-
MD5
732b03ac502db49cef973bd07b2bf87a
-
SHA1
ea356a1acfc1dfbf117a4bbbfbd57bcdc670fad1
-
SHA256
a6099c491eee80fe035edbaa41ca5efedd1fedecb115bcac9e5e549d63ce2f1e
-
SHA512
d3a114e9c2eeee1b798f5e588d49d27650bdb9857bd9e38d8051f69fee00f5733e879acbecc891a282ccb727d62a111a4fe24d4989bc17fef0e9ee9c798ccbbb
-
SSDEEP
98304:ECHmauGx7Pvr22SsaNYfdPBldt6+dBcjHtKRJ6B1IbzZjIbzZY:YaM7jGIa6K
-
Quasar payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-