General
-
Target
94ebfdfd713a28f05375cb3db05fa5223f67ef6d0e79d724c1d1fb808476227b
-
Size
3.9MB
-
Sample
241117-rpvcfa1hre
-
MD5
00ffe69dfb698299710ce724102c38d0
-
SHA1
f34a894792a087ccc190149a60b5ebd778205254
-
SHA256
94ebfdfd713a28f05375cb3db05fa5223f67ef6d0e79d724c1d1fb808476227b
-
SHA512
21cc0557ccdc228d358430dc0783c55c3d4cc54ca48241ae212fa97e8d7cfc475fad1247ff7b967b3cdc5187984cd918736687c23cea84cddd2ca70c3ab2f37d
-
SSDEEP
98304:Amfx0pcD2HsO4ntgdgxkvS4qdtdFRm5J0j0BTh2zR:Amf2ppHb+koMSRtJpkQt
Static task
static1
Behavioral task
behavioral1
Sample
94ebfdfd713a28f05375cb3db05fa5223f67ef6d0e79d724c1d1fb808476227b.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
CODE
twart.myfirewall.org:9792
rency.ydns.eu:5287
wqo9.firewall-gateway.de:8841
02351e291-5d041-4fa37-932c7-869aeiQec514992
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
workbook.exe
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
workbook
-
subdirectory
SubDir
Targets
-
-
Target
94ebfdfd713a28f05375cb3db05fa5223f67ef6d0e79d724c1d1fb808476227b
-
Size
3.9MB
-
MD5
00ffe69dfb698299710ce724102c38d0
-
SHA1
f34a894792a087ccc190149a60b5ebd778205254
-
SHA256
94ebfdfd713a28f05375cb3db05fa5223f67ef6d0e79d724c1d1fb808476227b
-
SHA512
21cc0557ccdc228d358430dc0783c55c3d4cc54ca48241ae212fa97e8d7cfc475fad1247ff7b967b3cdc5187984cd918736687c23cea84cddd2ca70c3ab2f37d
-
SSDEEP
98304:Amfx0pcD2HsO4ntgdgxkvS4qdtdFRm5J0j0BTh2zR:Amf2ppHb+koMSRtJpkQt
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-