General
-
Target
AA5DA5D211DD6B3C5E9404520EBEEC1F.exe
-
Size
3.1MB
-
Sample
240625-kpavgasfqm
-
MD5
aa5da5d211dd6b3c5e9404520ebeec1f
-
SHA1
037e6d5fa8398a3f95df469d60debe6fc8c93f89
-
SHA256
1b586bfe3423ef03ecba497e90fd31b42022dd8e1f325e212c1e23cc58ba7be7
-
SHA512
9a02a50c2534ece296d183bd712f8be240f4e5d989842656e28392af41036d29dc30cf205fe3526b980a480c54c3d9a4de7f5ef35103dec2d29fb513d2e83b72
-
SSDEEP
49152:PvSI22SsaNYfdPBldt698dBcjHod/oKT2fOTmZPKoGANtTHHB72eh2NT:Pv/22SsaNYfdPBldt6+dBcjHE/oKDg
Behavioral task
behavioral1
Sample
AA5DA5D211DD6B3C5E9404520EBEEC1F.exe
Resource
win7-20240508-en
Malware Config
Extracted
quasar
1.4.1
Office04
91.92.242.80:4782
e88cd5c3-d3f7-4cbb-94a7-7136e3bc6ab9
-
encryption_key
B1F363CB165B4ADD4702FD386A0A1054BFED678C
-
install_name
WindowsUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows.Update
-
subdirectory
Update
Targets
-
-
Target
AA5DA5D211DD6B3C5E9404520EBEEC1F.exe
-
Size
3.1MB
-
MD5
aa5da5d211dd6b3c5e9404520ebeec1f
-
SHA1
037e6d5fa8398a3f95df469d60debe6fc8c93f89
-
SHA256
1b586bfe3423ef03ecba497e90fd31b42022dd8e1f325e212c1e23cc58ba7be7
-
SHA512
9a02a50c2534ece296d183bd712f8be240f4e5d989842656e28392af41036d29dc30cf205fe3526b980a480c54c3d9a4de7f5ef35103dec2d29fb513d2e83b72
-
SSDEEP
49152:PvSI22SsaNYfdPBldt698dBcjHod/oKT2fOTmZPKoGANtTHHB72eh2NT:Pv/22SsaNYfdPBldt6+dBcjHE/oKDg
-
Quasar payload
-
Executes dropped EXE
-