General
-
Target
WindowsDefender.exe
-
Size
3.3MB
-
Sample
241126-z788bazqdy
-
MD5
1448aa339fc327144c92d9ab75f67dc0
-
SHA1
59a0f2ae25765dd3201b34967807ef3512b8dd96
-
SHA256
a1c8c48ee50425a76c78a1fc0dce9ca76f3ac4ea36e5a7f8ec553e5a348f88a0
-
SHA512
918c0bbb6c0359d3c180a5dcee661d18ebf909d7d65e6795d55c7abbdcade5cb10f3d39d709195b345324656bcc7d1952852203e35db577cd8ff55df19d33775
-
SSDEEP
49152:WvDhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaxxOEMkxk/JxCoGdWKTHHB72eh2NT:Wvbt2d5aKCuVPzlEmVQ0wvwfxxcwG
Malware Config
Extracted
quasar
1.4.1
Office04
general-later.gl.at.ply.gg:6227
e8e985a7-62a2-410d-91ea-7249972738eb
-
encryption_key
578EFB451288E8CFFF8CB67C63A1530F061DDBCD
-
install_name
WindowsDefender.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows.Defender.exe
-
subdirectory
SubDir
Targets
-
-
Target
WindowsDefender.exe
-
Size
3.3MB
-
MD5
1448aa339fc327144c92d9ab75f67dc0
-
SHA1
59a0f2ae25765dd3201b34967807ef3512b8dd96
-
SHA256
a1c8c48ee50425a76c78a1fc0dce9ca76f3ac4ea36e5a7f8ec553e5a348f88a0
-
SHA512
918c0bbb6c0359d3c180a5dcee661d18ebf909d7d65e6795d55c7abbdcade5cb10f3d39d709195b345324656bcc7d1952852203e35db577cd8ff55df19d33775
-
SSDEEP
49152:WvDhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaxxOEMkxk/JxCoGdWKTHHB72eh2NT:Wvbt2d5aKCuVPzlEmVQ0wvwfxxcwG
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-