General
-
Target
app.exe
-
Size
3.1MB
-
Sample
241215-s7n4taymdv
-
MD5
b8f097d5264902c9a54edf5cb26b4731
-
SHA1
4c2670bc094f0ed3b44de87fca95403073ddd81d
-
SHA256
93a291be0837344a2f715c9941a23b03232294865835f1dce8e81fdce5382bc9
-
SHA512
983ae07639c872fbcf07aac883f76f9cc04e7ad3b743be3d500818830ff0db8a9626a32ff7c8a7c3e11ff991a94d8c942d6702f3ec9d2aba7f65a3b290e980d5
-
SSDEEP
49152:OvWI22SsaNYfdPBldt698dBcjHddRJ6xbR3LoGdyVTHHB72eh2NT:Ov722SsaNYfdPBldt6+dBcjHddRJ6T
Behavioral task
behavioral1
Sample
app.exe
Resource
win7-20240729-en
Malware Config
Extracted
quasar
1.4.1
KDOTCrypt
fedx.ddns.net:7000
70b69453-9c90-490b-81c2-83279615d904
-
encryption_key
92470F4731518ABFA77DC89068544FB7E7B7C459
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
app.exe
-
Size
3.1MB
-
MD5
b8f097d5264902c9a54edf5cb26b4731
-
SHA1
4c2670bc094f0ed3b44de87fca95403073ddd81d
-
SHA256
93a291be0837344a2f715c9941a23b03232294865835f1dce8e81fdce5382bc9
-
SHA512
983ae07639c872fbcf07aac883f76f9cc04e7ad3b743be3d500818830ff0db8a9626a32ff7c8a7c3e11ff991a94d8c942d6702f3ec9d2aba7f65a3b290e980d5
-
SSDEEP
49152:OvWI22SsaNYfdPBldt698dBcjHddRJ6xbR3LoGdyVTHHB72eh2NT:Ov722SsaNYfdPBldt6+dBcjHddRJ6T
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-