General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240807-dfdfnsyhnn
-
MD5
8002dc8117cbe6ebcbfaf36bb28e88e3
-
SHA1
efe5eed3bc761e1e62f08ebc92805e9654b6aa24
-
SHA256
d6965856129d06addc58a24ddb896794c70ce2bd207c196ab9dc48dafc68b37f
-
SHA512
cefb48180f95e4b7d1405e64cfe0f18e94052a52d63b7c2a38a183fab158327a1e49cdb83d04646f7f19fd4bb8f6b36f1c19baef85813b77887f6b38b775ede1
-
SSDEEP
49152:XvrlL26AaNeWgPhlmVqvMQ7XSKqIYKjhtzoGd5THHB72eh2NT:XvRL26AaNeWgPhlmVqkQ7XSKqIYy
Malware Config
Extracted
quasar
1.4.1
Office04
techfor1-59332.portmap.host::59332
52632e42-8a63-4ed3-95d3-0a19933df815
-
encryption_key
6CA76EF64E195310669632231B8ED203A85BDDA1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
8002dc8117cbe6ebcbfaf36bb28e88e3
-
SHA1
efe5eed3bc761e1e62f08ebc92805e9654b6aa24
-
SHA256
d6965856129d06addc58a24ddb896794c70ce2bd207c196ab9dc48dafc68b37f
-
SHA512
cefb48180f95e4b7d1405e64cfe0f18e94052a52d63b7c2a38a183fab158327a1e49cdb83d04646f7f19fd4bb8f6b36f1c19baef85813b77887f6b38b775ede1
-
SSDEEP
49152:XvrlL26AaNeWgPhlmVqvMQ7XSKqIYKjhtzoGd5THHB72eh2NT:XvRL26AaNeWgPhlmVqkQ7XSKqIYy
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-