General
-
Target
d600758023374f78d58acafbcaf94af66ad203b28e22a.exe
-
Size
3.3MB
-
Sample
241020-ztvsrszdnf
-
MD5
e089ca24836249976e2d5dca3678e807
-
SHA1
8cf9c018fc37aa609b08d49de20e9856b643305b
-
SHA256
d600758023374f78d58acafbcaf94af66ad203b28e22a305e2a9d53768b7030f
-
SHA512
76173c832baf4f003f7a2242b1daa8e4021320040de84125d1796c8b67dc2582b607efa77d386db38f6eda5dec892c9fc947b1930695d14687391537aa060f5a
-
SSDEEP
49152:pvPI22SsaNYfdPBldt698dBcjHkxOEMk8k/JxpoGdCYTHHB72eh2NTf:pvA22SsaNYfdPBldt6+dBcjHkxnby
Behavioral task
behavioral1
Sample
d600758023374f78d58acafbcaf94af66ad203b28e22a.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
Office04
173.214.167.207:4782
feefbbd1-f830-4abb-beee-ba55da8cb629
-
encryption_key
51CB1F5A5C66153C4F993F7F3638B35B3A7597B3
-
install_name
DefenderScan.exe
-
log_directory
init
-
reconnect_delay
3000
-
startup_key
Defender
-
subdirectory
SubDir
Targets
-
-
Target
d600758023374f78d58acafbcaf94af66ad203b28e22a.exe
-
Size
3.3MB
-
MD5
e089ca24836249976e2d5dca3678e807
-
SHA1
8cf9c018fc37aa609b08d49de20e9856b643305b
-
SHA256
d600758023374f78d58acafbcaf94af66ad203b28e22a305e2a9d53768b7030f
-
SHA512
76173c832baf4f003f7a2242b1daa8e4021320040de84125d1796c8b67dc2582b607efa77d386db38f6eda5dec892c9fc947b1930695d14687391537aa060f5a
-
SSDEEP
49152:pvPI22SsaNYfdPBldt698dBcjHkxOEMk8k/JxpoGdCYTHHB72eh2NTf:pvA22SsaNYfdPBldt6+dBcjHkxnby
-
Quasar payload
-
Executes dropped EXE
-