General
-
Target
Reparador MTA.exe
-
Size
3.3MB
-
Sample
241216-bkczlaxreq
-
MD5
7c0fac689542f00caff659cbe037186f
-
SHA1
a541a77e67e2c768bfa69282ff926a50ce3412a1
-
SHA256
fe3d6fad8814926141da7cf0e91fc86c920b5e4a6ddf7c7d3d42c2a539421e24
-
SHA512
e5595f74acea7171c2baa2ca4000d3d54b5b0eb6d7323a3904eab1fb98c95c92f7dba83f7059b3482279cf490d0eee52a1967ba08a3540eca2b76cc96c341df2
-
SSDEEP
49152:1vSI22SsaNYfdPBldt698dBcjHRCl1JLLoGdSTHHB72eh2NT:1v/22SsaNYfdPBldt6+dBcjHRCF
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
SubDir
Targets
-
-
Target
Reparador MTA.exe
-
Size
3.3MB
-
MD5
7c0fac689542f00caff659cbe037186f
-
SHA1
a541a77e67e2c768bfa69282ff926a50ce3412a1
-
SHA256
fe3d6fad8814926141da7cf0e91fc86c920b5e4a6ddf7c7d3d42c2a539421e24
-
SHA512
e5595f74acea7171c2baa2ca4000d3d54b5b0eb6d7323a3904eab1fb98c95c92f7dba83f7059b3482279cf490d0eee52a1967ba08a3540eca2b76cc96c341df2
-
SSDEEP
49152:1vSI22SsaNYfdPBldt698dBcjHRCl1JLLoGdSTHHB72eh2NT:1v/22SsaNYfdPBldt6+dBcjHRCF
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-