General
-
Target
IMAVIRUS.exe
-
Size
3.1MB
-
Sample
241218-cj7cgsxqfz
-
MD5
9c9646fbf26b1fc0eaee890d08ad0551
-
SHA1
3924c30dea1f3e2f971c6d130c6faa81e6ff9302
-
SHA256
3f6e781c28be4da83a3278d17f3f1c615953f29a2dd5af8004960a9ee1291f57
-
SHA512
d5bec7b66fa53006a3b979530efced8b59b89d0aaadb6ea55f334b28ebea3b7430011ad0897ce91f551b98597f55dbfe5a6445c301c0861d642e01255b954ab6
-
SSDEEP
49152:rvOI22SsaNYfdPBldt698dBcjHCjRJ6rbR3LoGdxLTHHB72eh2NT:rvj22SsaNYfdPBldt6+dBcjHCjRJ69
Malware Config
Extracted
quasar
1.4.1
IMARAT
192.168.3.157:4782
d3b8ad08-6b28-4d2c-a53c-95588f033851
-
encryption_key
70BB1936556498784E09A3EE370936577EC65162
-
install_name
IMAVIRUS.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
IMAVIRUS
Targets
-
-
Target
IMAVIRUS.exe
-
Size
3.1MB
-
MD5
9c9646fbf26b1fc0eaee890d08ad0551
-
SHA1
3924c30dea1f3e2f971c6d130c6faa81e6ff9302
-
SHA256
3f6e781c28be4da83a3278d17f3f1c615953f29a2dd5af8004960a9ee1291f57
-
SHA512
d5bec7b66fa53006a3b979530efced8b59b89d0aaadb6ea55f334b28ebea3b7430011ad0897ce91f551b98597f55dbfe5a6445c301c0861d642e01255b954ab6
-
SSDEEP
49152:rvOI22SsaNYfdPBldt698dBcjHCjRJ6rbR3LoGdxLTHHB72eh2NT:rvj22SsaNYfdPBldt6+dBcjHCjRJ69
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-