General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
241217-14kk8a1mbr
-
MD5
b460be0db90b88f054f802bcb15c3085
-
SHA1
b3b4faa9d76b3b7c1a595d86b72105b9e42c564e
-
SHA256
6872f02318d5f28b83c7a19dab208002c06bc3261b8af28ce5ab46c5048e342b
-
SHA512
86b9d397e1320c960871d97dbb7fcc02a59bddd8b4fb9d9094a08856e8b6266fd525cbb89c857ba1907f356f4172bca9fdfefc0b26da47c7fb7e8d82ebb845f0
-
SSDEEP
49152:LvilL26AaNeWgPhlmVqvMQ7XSKYWBCpfoGdD4THHB72eh2NT:LvaL26AaNeWgPhlmVqkQ7XSKYWBCZ
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
science-attract.gl.at.ply.gg:4444
6ad33fe9-6ed2-45c9-940d-96954b1558e6
-
encryption_key
E040A051368780825E373BF53836EF5E3A5FBF62
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsDefender.exe
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
b460be0db90b88f054f802bcb15c3085
-
SHA1
b3b4faa9d76b3b7c1a595d86b72105b9e42c564e
-
SHA256
6872f02318d5f28b83c7a19dab208002c06bc3261b8af28ce5ab46c5048e342b
-
SHA512
86b9d397e1320c960871d97dbb7fcc02a59bddd8b4fb9d9094a08856e8b6266fd525cbb89c857ba1907f356f4172bca9fdfefc0b26da47c7fb7e8d82ebb845f0
-
SSDEEP
49152:LvilL26AaNeWgPhlmVqvMQ7XSKYWBCpfoGdD4THHB72eh2NT:LvaL26AaNeWgPhlmVqkQ7XSKYWBCZ
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-