General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240611-1jyx4ssgnc
-
MD5
609144570b9af0223264e261e36384cf
-
SHA1
2c2525c75e2af3cdeebec03d82257c3c29617595
-
SHA256
4942f8a2d315d2e65197abd6cf9330d2d025dcfd8c51ce7fda149c8f7605ab9a
-
SHA512
45684c59597c1fec9a16a0fe936c6500ae61403318a34321eaf91db70b1ca4c9ad04d4a0fbe08d01258f2b996b1ebcd99c407239986f28f77bd613a554021ded
-
SSDEEP
49152:bvTlL26AaNeWgPhlmVqvMQ7XSKa4m+mz6LoGdMCzsTHHB72eh2NT:bvJL26AaNeWgPhlmVqkQ7XSKa4mw8Cz
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240508-en
Malware Config
Extracted
quasar
1.4.1
Office04
com-cathedral.gl.at.ply.gg:60312:60312
7275eed2-cfc2-4aaa-85a9-989867afc89d
-
encryption_key
1F7D88978B03E5C08F9DEDBD0A0F2EF673BE9527
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
609144570b9af0223264e261e36384cf
-
SHA1
2c2525c75e2af3cdeebec03d82257c3c29617595
-
SHA256
4942f8a2d315d2e65197abd6cf9330d2d025dcfd8c51ce7fda149c8f7605ab9a
-
SHA512
45684c59597c1fec9a16a0fe936c6500ae61403318a34321eaf91db70b1ca4c9ad04d4a0fbe08d01258f2b996b1ebcd99c407239986f28f77bd613a554021ded
-
SSDEEP
49152:bvTlL26AaNeWgPhlmVqvMQ7XSKa4m+mz6LoGdMCzsTHHB72eh2NT:bvJL26AaNeWgPhlmVqkQ7XSKa4mw8Cz
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-