General
- Target Stub_1456.exe
- Size 3.2MB
- Sample240823-yzzs8stfkh
- SHA256 c017f0180ebf341506a961d56e62931298e3a315f26382015d6bbdf04b8ac1cc
- MD5 75bbc8d1c85cc88923efcbe268cf5f70
- SHA1 5cd20161023869b18376ef4b0e8923ebed5be322
- SHA512 9881845d5bee2d5863d657462f212f9f46c8ebc7b1a335354f88513d8ff495503bd657f1668e1a26ec37fc9a846600d6baadca5fda115bb773fa5c9f40104944
- SSDEEP 49152:bPL3rDCpMlyMuYg15lyxcjFWJ4JmQIYxm8Gbz9deqTHHB72eh2NT:bT7OpMOlWcjsJ4QQXxm
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Stub_1456.exe
Resource
win7-20240705-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Stub_1456.exe
Resource
win10-20240404-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
Stub_1456.exe
Resource
win10v2004-20240802-en
4 signatures
150 seconds
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Test
C2
-
147.185.221.22:13676
Mutex
-
aaf4767c-dd88-4c3f-9683-69a87558c907
Attributes
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Windows Host Process.exe
-
log_directory
Windows-Logs
-
reconnect_delay
3000
-
startup_key
Windows Host Process
-
subdirectory
Jerk
Targets
-
- Target Stub_1456.exe
- Size 3.2MB
- SHA256 c017f0180ebf341506a961d56e62931298e3a315f26382015d6bbdf04b8ac1cc
- MD5 75bbc8d1c85cc88923efcbe268cf5f70
- SHA1 5cd20161023869b18376ef4b0e8923ebed5be322
- SHA512 9881845d5bee2d5863d657462f212f9f46c8ebc7b1a335354f88513d8ff495503bd657f1668e1a26ec37fc9a846600d6baadca5fda115bb773fa5c9f40104944
- SSDEEP 49152:bPL3rDCpMlyMuYg15lyxcjFWJ4JmQIYxm8Gbz9deqTHHB72eh2NT:bT7OpMOlWcjsJ4QQXxm
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload