General
-
Target
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6.exe
-
Size
3.1MB
-
Sample
241217-dzpcaaypgt
-
MD5
5c73e901190eb50c2794a879a354417d
-
SHA1
e7e0e5552b9656e3790aa748f9af8774b606ed66
-
SHA256
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6
-
SHA512
fc3bb5c1c6b2917e6169cfc7633f91335eda82c68518f801e26805fc6381afb54508dbc689eb7c946ebe5e6195b37daa1639243e3fef3ee2073dbb1aa8495fd6
-
SSDEEP
49152:Wvkt62XlaSFNWPjljiFa2RoUYIf1So1J/UoGd8zTHHB72eh2NT:Wv462XlaSFNWPjljiFXRoUYIf1SX
Behavioral task
behavioral1
Sample
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
hilol.zapto.org:20
11bbf22e-826e-486b-b024-adbd86228a9e
-
encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ctfmon
-
subdirectory
SubDir
Targets
-
-
Target
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6.exe
-
Size
3.1MB
-
MD5
5c73e901190eb50c2794a879a354417d
-
SHA1
e7e0e5552b9656e3790aa748f9af8774b606ed66
-
SHA256
7ccfce0efe92cb5edd40257ce119bc91b50012c8081cb639aad6caab663a3ff6
-
SHA512
fc3bb5c1c6b2917e6169cfc7633f91335eda82c68518f801e26805fc6381afb54508dbc689eb7c946ebe5e6195b37daa1639243e3fef3ee2073dbb1aa8495fd6
-
SSDEEP
49152:Wvkt62XlaSFNWPjljiFa2RoUYIf1So1J/UoGd8zTHHB72eh2NT:Wv462XlaSFNWPjljiFXRoUYIf1SX
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-