General
-
Target
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
-
Size
3.1MB
-
Sample
241220-pahzrawjet
-
MD5
7f888b6cbd5062a7558eea61eb9a9ca2
-
SHA1
2acfb5c3e7b8e569ea52397154b9b3ffb44e7d87
-
SHA256
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
-
SHA512
7da70e844e0fce4b4bbc70db89503b95b6514cabf9ce9cf66fed643f6c11aafc5e7a8f385b5d16f7fa802cc47c9200bf486030834551d14c55078307ef7e93d8
-
SSDEEP
49152:/v2lL26AaNeWgPhlmVqvMQ7XSKKQSYmzwXoGdVTHHB72eh2NT:/v2L26AaNeWgPhlmVqkQ7XSKKQSq
Behavioral task
behavioral1
Sample
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
llordiWasHere-55715.portmap.host:55715
124c5996-13c0-46a2-804a-191042a109db
-
encryption_key
5F48258CBD7D9014A9443146E8A3D837D1715CAE
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
-
Size
3.1MB
-
MD5
7f888b6cbd5062a7558eea61eb9a9ca2
-
SHA1
2acfb5c3e7b8e569ea52397154b9b3ffb44e7d87
-
SHA256
864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
-
SHA512
7da70e844e0fce4b4bbc70db89503b95b6514cabf9ce9cf66fed643f6c11aafc5e7a8f385b5d16f7fa802cc47c9200bf486030834551d14c55078307ef7e93d8
-
SSDEEP
49152:/v2lL26AaNeWgPhlmVqvMQ7XSKKQSYmzwXoGdVTHHB72eh2NT:/v2L26AaNeWgPhlmVqkQ7XSKKQSq
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-