General
-
Target
Fifa 17 Installer Complement.exe
-
Size
3.1MB
-
Sample
241215-hxh5psxkhz
-
MD5
cc698361e8911889d46280f7f467cbe7
-
SHA1
125dd983ba5ef4b661ec6348d0fb746f6543bde9
-
SHA256
3b541b5dfba231ccc9a971f24469b8764360061643ac7510481ff9fea2b2f751
-
SHA512
3b3fdc15fcf8912da8a3b0512b20ec618108fd5208fe9de333f9c2dee54a4ee14ac19bfbe8ca68309872ec86ae7515c8d8f0dd7f6a56e8e8f0a72656b228d8bc
-
SSDEEP
49152:mvSI22SsaNYfdPBldt698dBcjH38d4jhrLoGdZaTHHB72eh2NT:mv/22SsaNYfdPBldt6+dBcjH38de
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Targets
-
-
Target
Fifa 17 Installer Complement.exe
-
Size
3.1MB
-
MD5
cc698361e8911889d46280f7f467cbe7
-
SHA1
125dd983ba5ef4b661ec6348d0fb746f6543bde9
-
SHA256
3b541b5dfba231ccc9a971f24469b8764360061643ac7510481ff9fea2b2f751
-
SHA512
3b3fdc15fcf8912da8a3b0512b20ec618108fd5208fe9de333f9c2dee54a4ee14ac19bfbe8ca68309872ec86ae7515c8d8f0dd7f6a56e8e8f0a72656b228d8bc
-
SSDEEP
49152:mvSI22SsaNYfdPBldt698dBcjH38d4jhrLoGdZaTHHB72eh2NT:mv/22SsaNYfdPBldt6+dBcjH38de
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-