General
- Target Client-built6test.exe
- Size 3.1MB
- Sample240906-2qq2hs1hkl
- SHA256 b1c92822d16d35d23b49c7920a327ac84109a9906ea85b566b17c99851a8800d
- MD5 3d0ac3ec8318d51449ca20014e27e6db
- SHA1 a4bf696ff20feea96aa595fa46264fdab0186deb
- SHA512 808d61ee7f31832e7656f49158a0796612872828ca9192502f8d810fb4dce28761f4a3fc5ac164b2d20e94353d31fc74c9569544746408bf1382ba650070f467
- SSDEEP 49152:OhF8mSA28qaZwpMPfl6/NK7xVcXbXxUEuMzTXV1tLfioGd24yVCKaGv2LkmNK:Oh2mF28qaZwpMPfl6lK7xOjqG4y
- MD5 SHA1 SHA512 SSDEEP
Behavioral task
behavioral1
Sample
Client-built6test.exe
Resource
win7-20240729-en
10 signatures
1800 seconds
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
incrediblew32-41135.portmap.host:41135
Mutex
-
e35e216e-411f-4600-b7d4-1b7e001ce1e6
Attributes
-
encryption_key
512BCCA0CE12E096E92A15ECCE78FFB787D7E9B2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win73
-
subdirectory
SubDir
Targets
-
- Target Client-built6test.exe
- Size 3.1MB
- SHA256 b1c92822d16d35d23b49c7920a327ac84109a9906ea85b566b17c99851a8800d
- MD5 3d0ac3ec8318d51449ca20014e27e6db
- SHA1 a4bf696ff20feea96aa595fa46264fdab0186deb
- SHA512 808d61ee7f31832e7656f49158a0796612872828ca9192502f8d810fb4dce28761f4a3fc5ac164b2d20e94353d31fc74c9569544746408bf1382ba650070f467
- SSDEEP 49152:OhF8mSA28qaZwpMPfl6/NK7xVcXbXxUEuMzTXV1tLfioGd24yVCKaGv2LkmNK:Oh2mF28qaZwpMPfl6lK7xOjqG4y
- MD5 SHA1 SHA512 SSDEEP
Quasar payload