General
-
Target
SATURN.exe
-
Size
3.1MB
-
Sample
240615-14z1xazhrq
-
MD5
9caa77268d8132074a904d624dc4856c
-
SHA1
c5c4e32b00d86faea028f86bd372cd2fdeba13a1
-
SHA256
c069010229253f99d384c4de835f41ba275f9198800e4fcb619424e437e1307f
-
SHA512
a9a004ed309355527c5ad8517cb10c3790779d071a970dc6cf4078f3e6488ef7fbbd1879a00b5c01bfecce065e527d2402c85cb4c55617c63dffa28e1ab931bf
-
SSDEEP
49152:3vnI22SsaNYfdPBldt698dBcjHEQxNESEnk/iXLoGdpBnTHHB72eh2NT:3vI22SsaNYfdPBldt6+dBcjHHxO75
Malware Config
Extracted
quasar
1.4.1
Office04
172.30.192.1:4782
2443f885-d042-451a-a2fc-de737d6723a1
-
encryption_key
BC6253027082850FC3ED1D2370095EE50583B588
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
SATURN.exe
-
Size
3.1MB
-
MD5
9caa77268d8132074a904d624dc4856c
-
SHA1
c5c4e32b00d86faea028f86bd372cd2fdeba13a1
-
SHA256
c069010229253f99d384c4de835f41ba275f9198800e4fcb619424e437e1307f
-
SHA512
a9a004ed309355527c5ad8517cb10c3790779d071a970dc6cf4078f3e6488ef7fbbd1879a00b5c01bfecce065e527d2402c85cb4c55617c63dffa28e1ab931bf
-
SSDEEP
49152:3vnI22SsaNYfdPBldt698dBcjHEQxNESEnk/iXLoGdpBnTHHB72eh2NT:3vI22SsaNYfdPBldt6+dBcjHHxO75
-
Quasar payload
-
Executes dropped EXE
-