General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240628-g9tarsyblq
-
MD5
32bb0a34ec761b84719ba4e23bb812e7
-
SHA1
a9bb8d3418ac232997b54961d640922606ffe734
-
SHA256
540a815a873aae037d0cb5bc5a9b8288acd6d83024860d79923f695dd379f22f
-
SHA512
9264a68fb34069b759298baf1d0ec708133bf9b00caf3aec99e2e7a787c099948aa9c2469bc01c12d24d3323f5fcbc26ab8abc34ff4ad0bb90e500db67adba87
-
SSDEEP
49152:KvEt62XlaSFNWPjljiFa2RoUYIzFitmtMfDBoGdmWTHHB72eh2NT:KvY62XlaSFNWPjljiFXRoUYIzFitm+
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.1:29643
9bda9817-7d07-49e7-92d5-dcaf6b89216c
-
encryption_key
31B6B433E91FDBAAD05B632B163CCF988D67E433
-
install_name
system.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svc
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
32bb0a34ec761b84719ba4e23bb812e7
-
SHA1
a9bb8d3418ac232997b54961d640922606ffe734
-
SHA256
540a815a873aae037d0cb5bc5a9b8288acd6d83024860d79923f695dd379f22f
-
SHA512
9264a68fb34069b759298baf1d0ec708133bf9b00caf3aec99e2e7a787c099948aa9c2469bc01c12d24d3323f5fcbc26ab8abc34ff4ad0bb90e500db67adba87
-
SSDEEP
49152:KvEt62XlaSFNWPjljiFa2RoUYIzFitmtMfDBoGdmWTHHB72eh2NT:KvY62XlaSFNWPjljiFXRoUYIzFitm+
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-