General
-
Target
dd4680359347745aa7ce45caf96c90d366e178f1602abbedd0129d1ac37288f9
-
Size
3.1MB
-
Sample
241209-ekx7batrhp
-
MD5
4ac535d06e17b269b25eedb97d88411a
-
SHA1
0e4aeb453e54fb9bacbbe802852db63f8d6d19b6
-
SHA256
dd4680359347745aa7ce45caf96c90d366e178f1602abbedd0129d1ac37288f9
-
SHA512
586ba0c8aec409466c3169ce71c93e4d180bc41976f70939e89b575cf9baf4b8900bab1028d9b29fff173b2bcfb1b4df34d411be6fa557bf63f018f18c9b1908
-
SSDEEP
49152:6vht62XlaSFNWPjljiFa2RoUYI1PxNESEjk/i3LoGdigTHHB72eh2NT:6vL62XlaSFNWPjljiFXRoUYIFxyb
Behavioral task
behavioral1
Sample
dd4680359347745aa7ce45caf96c90d366e178f1602abbedd0129d1ac37288f9.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
interestingsigma.hopto.org:20
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Targets
-
-
Target
dd4680359347745aa7ce45caf96c90d366e178f1602abbedd0129d1ac37288f9
-
Size
3.1MB
-
MD5
4ac535d06e17b269b25eedb97d88411a
-
SHA1
0e4aeb453e54fb9bacbbe802852db63f8d6d19b6
-
SHA256
dd4680359347745aa7ce45caf96c90d366e178f1602abbedd0129d1ac37288f9
-
SHA512
586ba0c8aec409466c3169ce71c93e4d180bc41976f70939e89b575cf9baf4b8900bab1028d9b29fff173b2bcfb1b4df34d411be6fa557bf63f018f18c9b1908
-
SSDEEP
49152:6vht62XlaSFNWPjljiFa2RoUYI1PxNESEjk/i3LoGdigTHHB72eh2NT:6vL62XlaSFNWPjljiFXRoUYIFxyb
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-