General
-
Target
xeno.exe
-
Size
3.1MB
-
Sample
250109-ml969szkgm
-
MD5
b41a318867f211209a6667cce4681bce
-
SHA1
e4cb286b8ba7f7d311453b7066b32c1650d1ffdb
-
SHA256
fe33baebf921d81c28b5c28ef1320a4f06f4e725e18c9547b0f3b23acf26afd6
-
SHA512
5c7814c9d807f06b1dbd01a9125fd501beed4f9d6afb30a94dc9284ed54badcd5c6c1f6a5f2dfbf8e1e9d137ad0291e2f540f1546d8eef359b5759793aa4400a
-
SSDEEP
49152:av3I22SsaNYfdPBldt698dBcjHwJRJ6ebR3LoGdMywTHHB72eh2NT:av422SsaNYfdPBldt6+dBcjHwJRJ6Y
Behavioral task
behavioral1
Sample
xeno.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.68.1:4782
948fde50-66bb-4ffd-aeca-4cc76d13c423
-
encryption_key
FE78C5AAB1B8DB7C1492A05B7A35D613C6807754
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
xeno.exe
-
Size
3.1MB
-
MD5
b41a318867f211209a6667cce4681bce
-
SHA1
e4cb286b8ba7f7d311453b7066b32c1650d1ffdb
-
SHA256
fe33baebf921d81c28b5c28ef1320a4f06f4e725e18c9547b0f3b23acf26afd6
-
SHA512
5c7814c9d807f06b1dbd01a9125fd501beed4f9d6afb30a94dc9284ed54badcd5c6c1f6a5f2dfbf8e1e9d137ad0291e2f540f1546d8eef359b5759793aa4400a
-
SSDEEP
49152:av3I22SsaNYfdPBldt698dBcjHwJRJ6ebR3LoGdMywTHHB72eh2NT:av422SsaNYfdPBldt6+dBcjHwJRJ6Y
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-