General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240806-pg2enssgmf
-
MD5
7e5094dbfce8b71e8814df7a5ededc84
-
SHA1
9ac3e5cf625c358dd6baaaa61b6b76ba34c2e1ee
-
SHA256
318390544fc2de709b38adaee1739346b499c661bb9b3459b483d6cca0727f10
-
SHA512
2232a853eabaaf79d7cacd9bac6fc03b186be9eb9009a86cafc776f3661b75822c6f5e8daf05ef019639ee0d31a8881fce7967d1d564a106a5b08b587d9c2a30
-
SSDEEP
49152:ivkt62XlaSFNWPjljiFa2RoUYIgRxNESEBk/ivLoGdYPTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYImxIz
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.6:4782
052bf88a-973b-4098-96b2-b3098734aab4
-
encryption_key
C82052C6AA81D4430841915516E777F1172AA1B4
-
install_name
incognito.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
JavaUpdater
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
7e5094dbfce8b71e8814df7a5ededc84
-
SHA1
9ac3e5cf625c358dd6baaaa61b6b76ba34c2e1ee
-
SHA256
318390544fc2de709b38adaee1739346b499c661bb9b3459b483d6cca0727f10
-
SHA512
2232a853eabaaf79d7cacd9bac6fc03b186be9eb9009a86cafc776f3661b75822c6f5e8daf05ef019639ee0d31a8881fce7967d1d564a106a5b08b587d9c2a30
-
SSDEEP
49152:ivkt62XlaSFNWPjljiFa2RoUYIgRxNESEBk/ivLoGdYPTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYImxIz
-
Quasar payload
-
Executes dropped EXE
-