General
-
Target
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601
-
Size
3.1MB
-
Sample
241102-zaq1gatraz
-
MD5
9beba9a55f44cbc0491d0fd829602e21
-
SHA1
392fd8116093068ec28a5ad42b4a5e27fc598991
-
SHA256
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601
-
SHA512
b565b1ad44fc00bf761e1a1c8b461b91e367db5d97bac83dc7a1debe43bd8587d6e38a8dc5671d637a26a794f25bfea097b44917ffec49b272c3d93636aa67fc
-
SSDEEP
49152:vvlt62XlaSFNWPjljiFa2RoUYIU8RJ6KbR3LoGdDTHHB72eh2NT:vvX62XlaSFNWPjljiFXRoUYIU8RJ6k
Behavioral task
behavioral1
Sample
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
Ethera perm
192.168.0.14:4782
e6dee05f-f73f-4996-8dcd-aa3306f88702
-
encryption_key
C7E0C7E9C05F4E721194E42F9D56A31CF511203D
-
install_name
provops1.exe
-
log_directory
winfier
-
reconnect_delay
3000
-
startup_key
Programm
Targets
-
-
Target
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601
-
Size
3.1MB
-
MD5
9beba9a55f44cbc0491d0fd829602e21
-
SHA1
392fd8116093068ec28a5ad42b4a5e27fc598991
-
SHA256
234297693c541154fba6ba3cf348af44740cb3cb226669cb96ad12206e187601
-
SHA512
b565b1ad44fc00bf761e1a1c8b461b91e367db5d97bac83dc7a1debe43bd8587d6e38a8dc5671d637a26a794f25bfea097b44917ffec49b272c3d93636aa67fc
-
SSDEEP
49152:vvlt62XlaSFNWPjljiFa2RoUYIU8RJ6KbR3LoGdDTHHB72eh2NT:vvX62XlaSFNWPjljiFXRoUYIU8RJ6k
Score10/10-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-