General
-
Target
310aa0b2e7d5cda89657fea41c2a840f0a2344b5d42a7461f36e76dbb1ddb75d.exe
-
Size
3.1MB
-
Sample
250116-wgzdms1rgy
-
MD5
0369e1ea77e6b56db5cf74aaa45db136
-
SHA1
c0e2a36b33159e479b5e63e02aee9b5709d4237d
-
SHA256
310aa0b2e7d5cda89657fea41c2a840f0a2344b5d42a7461f36e76dbb1ddb75d
-
SHA512
0143137573bcc0c3ac8bcd3877bcb61cbb51b484a3be06ae5361e4940048e99f5f9e416b6e0bff93cc78764d1f0ae1091781d49c294e41a0a2f926aad6f3bf7e
-
SSDEEP
49152:Ovtt62XlaSFNWPjljiFa2RoUYIcmRJ6DbR3LoGd8DTHHB72eh2NTR:OvP62XlaSFNWPjljiFXRoUYIcmRJ61r
Behavioral task
behavioral1
Sample
310aa0b2e7d5cda89657fea41c2a840f0a2344b5d42a7461f36e76dbb1ddb75d.exe
Resource
win7-20241023-en
Malware Config
Extracted
quasar
1.4.1
Office06
154.216.19.77:7000
1e8aec43-b30a-4c63-9211-c18c9decd0e0
-
encryption_key
2A64449428B4580ED5FC6EE66024E26C725626BE
-
install_name
s.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ssssss
-
subdirectory
dir
Targets
-
-
Target
310aa0b2e7d5cda89657fea41c2a840f0a2344b5d42a7461f36e76dbb1ddb75d.exe
-
Size
3.1MB
-
MD5
0369e1ea77e6b56db5cf74aaa45db136
-
SHA1
c0e2a36b33159e479b5e63e02aee9b5709d4237d
-
SHA256
310aa0b2e7d5cda89657fea41c2a840f0a2344b5d42a7461f36e76dbb1ddb75d
-
SHA512
0143137573bcc0c3ac8bcd3877bcb61cbb51b484a3be06ae5361e4940048e99f5f9e416b6e0bff93cc78764d1f0ae1091781d49c294e41a0a2f926aad6f3bf7e
-
SSDEEP
49152:Ovtt62XlaSFNWPjljiFa2RoUYIcmRJ6DbR3LoGd8DTHHB72eh2NTR:OvP62XlaSFNWPjljiFXRoUYIcmRJ61r
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-