General
-
Target
8e5a34b932374eae6c3d0d71bef8d34f4f91cc31908ff596533f5fec1a5ff592.exe
-
Size
3.1MB
-
Sample
241218-dlmxas1qhm
-
MD5
02130800d200407967cb08abbb0aeefe
-
SHA1
6df9a3b4879c3d34b51826bd1d9ad0f64c93d11e
-
SHA256
8e5a34b932374eae6c3d0d71bef8d34f4f91cc31908ff596533f5fec1a5ff592
-
SHA512
dccf995ac63f9386c909608bd948fe41b64aae9df87c6db2cf158de933dd3d8eaabd3215da98911d51af48fab71b992ea72eed3d807c4ebe0d6ef9927c78a84d
-
SSDEEP
49152:nvrlL26AaNeWgPhlmVqvMQ7XSKvgEcqBxZCoGdYTHHB72eh2NT:nvRL26AaNeWgPhlmVqkQ7XSKHcd
Behavioral task
behavioral1
Sample
8e5a34b932374eae6c3d0d71bef8d34f4f91cc31908ff596533f5fec1a5ff592.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
Office04
suport24.ddns.net:4782
192.168.1.74:4782
b4ad83f8-b608-477d-8395-2274bcaab6d1
-
encryption_key
62EF51244AF3535A6A9C77206CD89D5BFECD7E4E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
8e5a34b932374eae6c3d0d71bef8d34f4f91cc31908ff596533f5fec1a5ff592.exe
-
Size
3.1MB
-
MD5
02130800d200407967cb08abbb0aeefe
-
SHA1
6df9a3b4879c3d34b51826bd1d9ad0f64c93d11e
-
SHA256
8e5a34b932374eae6c3d0d71bef8d34f4f91cc31908ff596533f5fec1a5ff592
-
SHA512
dccf995ac63f9386c909608bd948fe41b64aae9df87c6db2cf158de933dd3d8eaabd3215da98911d51af48fab71b992ea72eed3d807c4ebe0d6ef9927c78a84d
-
SSDEEP
49152:nvrlL26AaNeWgPhlmVqvMQ7XSKvgEcqBxZCoGdYTHHB72eh2NT:nvRL26AaNeWgPhlmVqkQ7XSKHcd
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-