General
-
Target
HwidChecker.exe
-
Size
3.1MB
-
Sample
240806-vm4pwavbrk
-
MD5
b6f7686e5d162b9ad7fc3c829c98f2e8
-
SHA1
9262f36af2986a6c8459b91a76064b1a86f66550
-
SHA256
3aad476bc33ebbca38d7def91669e379a3563aaa7f5beddf9cfa0994946a2294
-
SHA512
506691916a3fd10b0470069e1afaaf18473cfd9025fd3c2b3359bb780ac36250142bc02237778bb2a58d534f31b97c7423d2b98797565a275e3ccc1fb14f57ad
-
SSDEEP
49152:yvUt62XlaSFNWPjljiFa2RoUYI+C81Jn6oGdJTHHB72eh2NT:yvI62XlaSFNWPjljiFXRoUYI+CJ
Behavioral task
behavioral1
Sample
HwidChecker.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
Office04
10.0.0.91:4782
9ed05a87-25fb-402e-a6a4-b613c5088d3d
-
encryption_key
1E317FE2D0D84B0CA0BFA596778B8CC9702863D6
-
install_name
HwidChecker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
HwidChecker.exe
-
Size
3.1MB
-
MD5
b6f7686e5d162b9ad7fc3c829c98f2e8
-
SHA1
9262f36af2986a6c8459b91a76064b1a86f66550
-
SHA256
3aad476bc33ebbca38d7def91669e379a3563aaa7f5beddf9cfa0994946a2294
-
SHA512
506691916a3fd10b0470069e1afaaf18473cfd9025fd3c2b3359bb780ac36250142bc02237778bb2a58d534f31b97c7423d2b98797565a275e3ccc1fb14f57ad
-
SSDEEP
49152:yvUt62XlaSFNWPjljiFa2RoUYI+C81Jn6oGdJTHHB72eh2NT:yvI62XlaSFNWPjljiFXRoUYI+CJ
-
Quasar payload
-
Executes dropped EXE
-