General
-
Target
SpoofX.exe
-
Size
3.1MB
-
Sample
241220-aah77atrem
-
MD5
f6cbf782a601526dc279891b0600d2c8
-
SHA1
0e561270b8d8fb960cf9bf9f8ddab94517de03ec
-
SHA256
bd0551475a48100dfd099d8ea6412240c9310438357a671af47e5580d108875e
-
SHA512
4cc7ace57e510dcbb3019d0f48f9c76f4b2b9a251ce5752e0af5d704bc7ceccbccef770ccc0f3c5188c97045939f6a93d42a3ec5efe17561f3eb1586a22dbdc8
-
SSDEEP
49152:evBt62XlaSFNWPjljiFa2RoUYIg9zE24Uk/07hoGd8THHB72eh2NT:evr62XlaSFNWPjljiFXRoUYIg9rl
Behavioral task
behavioral1
Sample
SpoofX.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SpoofX.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
Svchost.exe
192.168.1.190:4782
75ec4d04-9201-465b-9d52-07fbf8901610
-
encryption_key
BC9F0EB6E1FA6B8559DDF8DE0AEF08110EBCF8E5
-
install_name
Svchostt.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Svchostt.exe
-
subdirectory
SubDir
Targets
-
-
Target
SpoofX.exe
-
Size
3.1MB
-
MD5
f6cbf782a601526dc279891b0600d2c8
-
SHA1
0e561270b8d8fb960cf9bf9f8ddab94517de03ec
-
SHA256
bd0551475a48100dfd099d8ea6412240c9310438357a671af47e5580d108875e
-
SHA512
4cc7ace57e510dcbb3019d0f48f9c76f4b2b9a251ce5752e0af5d704bc7ceccbccef770ccc0f3c5188c97045939f6a93d42a3ec5efe17561f3eb1586a22dbdc8
-
SSDEEP
49152:evBt62XlaSFNWPjljiFa2RoUYIg9zE24Uk/07hoGd8THHB72eh2NT:evr62XlaSFNWPjljiFXRoUYIg9rl
Score10/10-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-