General
-
Target
d3aawerfsegdrgilt.exe
-
Size
3.1MB
-
Sample
240611-1mgs1ashlm
-
MD5
44c693d6d5ffd855bac13640f4911158
-
SHA1
2ca8f8165a6d33e6729586d07ed58192e86fec22
-
SHA256
d22c92341e402b568ec0f68e8f41ae34238931107138f5d181a25d64c3b54987
-
SHA512
b00106019d43379f33ffb64f429d87490ed35f99fa7d532ee4c2c920fac7eeb78f96ae6f9cba7a775a25075df08f6ae4a28990d9862478af95747f576d9e6e1d
-
SSDEEP
49152:Xvpgo2QSaNpzyPllgamb0CZof/JYz/hBx/LoGdqxTHHB72eh2NT:XvKo2QSaNpzyPllgamYCZof/JA/1a
Behavioral task
behavioral1
Sample
d3aawerfsegdrgilt.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
1998:1998
60312:1998
com-cathedral.gl.at.ply.gg:1998
147.185.221.19:60312:1998
147.185.221.19:1998
147.185.221.19:60312
7275eed2-cfc2-4aaa-85a9-989867afc89d
-
encryption_key
1F7D88978B03E5C08F9DEDBD0A0F2EF673BE9527
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
d3aawerfsegdrgilt.exe
-
Size
3.1MB
-
MD5
44c693d6d5ffd855bac13640f4911158
-
SHA1
2ca8f8165a6d33e6729586d07ed58192e86fec22
-
SHA256
d22c92341e402b568ec0f68e8f41ae34238931107138f5d181a25d64c3b54987
-
SHA512
b00106019d43379f33ffb64f429d87490ed35f99fa7d532ee4c2c920fac7eeb78f96ae6f9cba7a775a25075df08f6ae4a28990d9862478af95747f576d9e6e1d
-
SSDEEP
49152:Xvpgo2QSaNpzyPllgamb0CZof/JYz/hBx/LoGdqxTHHB72eh2NT:XvKo2QSaNpzyPllgamYCZof/JA/1a
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-