General
-
Target
smss.exe
-
Size
3.1MB
-
Sample
240621-hhz5nstgnl
-
MD5
e892f6b514297ffa73a5271d66d5180b
-
SHA1
10f5886d28d48454581af2e05bf3fe3d6fd9b763
-
SHA256
c65baefaf8047a324638ae5f04d3a0a5557c02ff7e65d99ebd25754272bab2e0
-
SHA512
a74874e3d909c71c0a458b940b37cece4ffea85af4ad34ec7421289a61eb547955333358e46c4be5ba38d93469226ae264cee2b0a26191c0b1be45a89beb8f33
-
SSDEEP
49152:LvilL26AaNeWgPhlmVqvMQ7XSKh4RJ6HbR3LoGdafTHHB72eh2NT:LvaL26AaNeWgPhlmVqkQ7XSKh4RJ6Z
Malware Config
Extracted
quasar
1.4.1
Office04
carolina-reverse.gl.at.ply.gg:34609
255a7afd-a9a3-4b9f-b4bc-647ca1724a1a
-
encryption_key
524892BD8A433CE8E6A342E36737F573CEF5D252
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
smss.exe
-
Size
3.1MB
-
MD5
e892f6b514297ffa73a5271d66d5180b
-
SHA1
10f5886d28d48454581af2e05bf3fe3d6fd9b763
-
SHA256
c65baefaf8047a324638ae5f04d3a0a5557c02ff7e65d99ebd25754272bab2e0
-
SHA512
a74874e3d909c71c0a458b940b37cece4ffea85af4ad34ec7421289a61eb547955333358e46c4be5ba38d93469226ae264cee2b0a26191c0b1be45a89beb8f33
-
SSDEEP
49152:LvilL26AaNeWgPhlmVqvMQ7XSKh4RJ6HbR3LoGdafTHHB72eh2NT:LvaL26AaNeWgPhlmVqkQ7XSKh4RJ6Z
-
Quasar payload
-