Resubmissions
06-11-2024 14:36
241106-ry24mstrdl 10General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
241106-ry24mstrdl
-
MD5
6fad631f98ce4dd18768a24f4c30eb89
-
SHA1
2fb91ad5b71ffb0e5f6aaf596504e3cbdcd6e8c6
-
SHA256
b6a9d5b847a9b36874a2b95dab1b7e3fbe0a9fa0ac0577598b0810bd31798bfb
-
SHA512
825f45d6492fda82be6012eec9c4ddb5c67f0ec93551d17375a591f5f9fe099058ca83c707e74d736ea2b4906e3c07260296e00ac6be8994714b64f09f4818b8
-
SSDEEP
49152:uv+I22SsaNYfdPBldt698dBcjHsC41JnKoGdl2cTHHB72eh2NT:uvz22SsaNYfdPBldt6+dBcjHsCp
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240708-en
Malware Config
Extracted
quasar
1.4.1
Office04
heyhey5577-38424.portmap.host:38424
81fe4881-d995-475f-a69c-87b3e84568e5
-
encryption_key
36434604456E6FAC74D069938FAF746337F3F873
-
install_name
winupdate.exe
-
log_directory
UpdaterInfo
-
reconnect_delay
3000
-
startup_key
winsysupdater
-
subdirectory
WlNDOWS
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
6fad631f98ce4dd18768a24f4c30eb89
-
SHA1
2fb91ad5b71ffb0e5f6aaf596504e3cbdcd6e8c6
-
SHA256
b6a9d5b847a9b36874a2b95dab1b7e3fbe0a9fa0ac0577598b0810bd31798bfb
-
SHA512
825f45d6492fda82be6012eec9c4ddb5c67f0ec93551d17375a591f5f9fe099058ca83c707e74d736ea2b4906e3c07260296e00ac6be8994714b64f09f4818b8
-
SSDEEP
49152:uv+I22SsaNYfdPBldt698dBcjHsC41JnKoGdl2cTHHB72eh2NT:uvz22SsaNYfdPBldt6+dBcjHsCp
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-