General
-
Target
Client-built.cgcgfc exe.exe
-
Size
3.1MB
-
Sample
240627-19xgzathna
-
MD5
9223ab0ca4806bf3dd04028102f419f6
-
SHA1
328c1c84dbd3f86dbb73d685fadd73ff5b9b3ed8
-
SHA256
4af60d406e55a778908d791016f1afc14b6b72253197328264e4939eddcb7d68
-
SHA512
ad0f6f573e885ca9c382cb1fdc86963373c4fc27f4c09a572aed4e6a22bfa4db34c2e987ff4afa999f2cfb024039f9d08911b6cb0089eb14d92ca8fbe366d771
-
SSDEEP
49152:yv0t62XlaSFNWPjljiFa2RoUYIARk81JHGoGd2THHB72eh2NT:yvo62XlaSFNWPjljiFXRoUYIARkJ
Malware Config
Extracted
quasar
1.4.1
Office04
/0.tcp.eu.ngrok.io:12165
fbfe2df1-f4ca-4d07-920f-4075f27bc8a1
-
encryption_key
B22432E943AA88394E5F97387369DCA7D8B67608
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
system 32
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.cgcgfc exe.exe
-
Size
3.1MB
-
MD5
9223ab0ca4806bf3dd04028102f419f6
-
SHA1
328c1c84dbd3f86dbb73d685fadd73ff5b9b3ed8
-
SHA256
4af60d406e55a778908d791016f1afc14b6b72253197328264e4939eddcb7d68
-
SHA512
ad0f6f573e885ca9c382cb1fdc86963373c4fc27f4c09a572aed4e6a22bfa4db34c2e987ff4afa999f2cfb024039f9d08911b6cb0089eb14d92ca8fbe366d771
-
SSDEEP
49152:yv0t62XlaSFNWPjljiFa2RoUYIARk81JHGoGd2THHB72eh2NT:yvo62XlaSFNWPjljiFXRoUYIARkJ
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-