General
-
Target
CandyDDoser-installerx32.exe
-
Size
3.1MB
-
Sample
250126-m11w5s1kcr
-
MD5
b020b1f73c110300f25ae110b3dd59df
-
SHA1
8bfa300b77c9c3e302001311d88568d816c590ae
-
SHA256
ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
-
SHA512
98047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339
-
SSDEEP
49152:/v7I22SsaNYfdPBldt698dBcjHQ0lRJ61bR3LoGdL1THHB72eh2NTz:/vE22SsaNYfdPBldt6+dBcjHQ0lRJ6H
Behavioral task
behavioral1
Sample
CandyDDoser-installerx32.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CandyDDoser-installerx32.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
CandyDDoser-Installer
127.0.0.1:5656
a4451484-07b3-4077-bce4-aad7f3859a48
-
encryption_key
0BF10FE69CA9AD8F67C8185E9EEB25C381EB6210
-
install_name
system32remove.exe
-
log_directory
Logs
-
reconnect_delay
10
-
startup_key
system32
-
subdirectory
Windows
Targets
-
-
Target
CandyDDoser-installerx32.exe
-
Size
3.1MB
-
MD5
b020b1f73c110300f25ae110b3dd59df
-
SHA1
8bfa300b77c9c3e302001311d88568d816c590ae
-
SHA256
ab7f57812dcc2c9ddd51aa06afdbc083d6f42dc8a4d1a9f2ab91bcee9722fef3
-
SHA512
98047f3bab00b4c4d6a3a23c0d31c7940328a8d6d1cfed1173ead3b094fc95ba18f57729a75045f9d5c7a8e5c1e9496f12617efc7a370a75e6c87b25455b9339
-
SSDEEP
49152:/v7I22SsaNYfdPBldt698dBcjHQ0lRJ61bR3LoGdL1THHB72eh2NTz:/vE22SsaNYfdPBldt6+dBcjHQ0lRJ6H
Score10/10-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-