General
- Target Client-built.exe
- Size 3.1MB
- Sample240904-apy7ys1cqj
- SHA256 653296e4b1110de7cc56d24f79a9782b39645669347058cf9349956c01ec1b58
- MD5 81eb38f10e72b74c40cba8391d2b0b2a
- SHA1 2cd4a476bf9a696978602f91f23f907c485fc308
- SHA512 b0c41f2c64bcdd4f34c722e73dabeced5a39e37b833e045a18abf1bbfa427e7e5d5a154957b46ae726669192ba03bb30a8465e0efb3fd319628465c13b40117c
- SSDEEP 98304:EwY0wY7sfIiRmBxKhe732M9FCuybQZhwdDel1:xx0QZ5
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
6 signatures
150 seconds
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
147.185.221.22:34344
Mutex
-
64e25f4b-3ded-4cd9-84c9-af460903ec7f
Attributes
-
encryption_key
7E5AC03E4AED67063F3FADC39DF8599FF4500C48
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target Client-built.exe
- Size 3.1MB
- SHA256 653296e4b1110de7cc56d24f79a9782b39645669347058cf9349956c01ec1b58
- MD5 81eb38f10e72b74c40cba8391d2b0b2a
- SHA1 2cd4a476bf9a696978602f91f23f907c485fc308
- SHA512 b0c41f2c64bcdd4f34c722e73dabeced5a39e37b833e045a18abf1bbfa427e7e5d5a154957b46ae726669192ba03bb30a8465e0efb3fd319628465c13b40117c
- SSDEEP 98304:EwY0wY7sfIiRmBxKhe732M9FCuybQZhwdDel1:xx0QZ5
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload