General
-
Target
dc17a1ec3a9bb84d21a7f6a7e77133f6.exe
-
Size
2.1MB
-
Sample
241101-ecrpkavkgv
-
MD5
dc17a1ec3a9bb84d21a7f6a7e77133f6
-
SHA1
2a6c10ea20bff9e297770bca2477a8bb82378c45
-
SHA256
82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954
-
SHA512
eb321ab29735ecf574939cd01ee51f04a623382d83d22d8efc6538a1618af0bfa3a8407b0f6e3c54f55e4a780e2f5176004d50f9598a0a9935207635810cc042
-
SSDEEP
49152:YX5YSZrAEzwpX/qR0KlOmOdXcyhgkkTScqMkRnGfRlz+:K5YC4o0MOdX4zSPnGZh+
Static task
static1
Behavioral task
behavioral1
Sample
dc17a1ec3a9bb84d21a7f6a7e77133f6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc17a1ec3a9bb84d21a7f6a7e77133f6.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
panel.o7lab.me
panel.o7lab.me:4782
service.o7lab.xyz:4782
underground-cheat.xyz:4782
service.o7lab.com.tr:4782
84f88b7e-fbb8-40b1-829a-206ff17d9f29
-
encryption_key
9D5D5E73AB412A75009506F89BC73714AF89F744
-
install_name
Client.exe
-
log_directory
WinLog
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
dc17a1ec3a9bb84d21a7f6a7e77133f6.exe
-
Size
2.1MB
-
MD5
dc17a1ec3a9bb84d21a7f6a7e77133f6
-
SHA1
2a6c10ea20bff9e297770bca2477a8bb82378c45
-
SHA256
82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954
-
SHA512
eb321ab29735ecf574939cd01ee51f04a623382d83d22d8efc6538a1618af0bfa3a8407b0f6e3c54f55e4a780e2f5176004d50f9598a0a9935207635810cc042
-
SSDEEP
49152:YX5YSZrAEzwpX/qR0KlOmOdXcyhgkkTScqMkRnGfRlz+:K5YC4o0MOdX4zSPnGZh+
Score10/10-
Quasar family
-
Quasar payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops startup file
-
Suspicious use of SetThreadContext
-