General
-
Target
Cl1ient-built.exe
-
Size
3.1MB
-
Sample
240628-ha681sybrr
-
MD5
00cac0e352ee5c12911f4eb29a34deac
-
SHA1
1bb09225aa309fc793e1eb27faa1ff8b1ccf9e50
-
SHA256
8b5341639e104df91c0dcbd5cec78286fa9b0fae7d19b637f3a11b93b48b655f
-
SHA512
9c7c0b55e794132a0d1a624a4326e33bbeedbac18f3af984cb3f6f81b6e4d534b63de23f027436eb85fdc40c1f4d8ccf1bd991b27e6303b35c975c78a4daa839
-
SSDEEP
49152:PvDI22SsaNYfdPBldt698dBcjHaLPnVjoGdhHTHHB72eh2NT:Pv822SsaNYfdPBldt6+dBcjHaTntx
Behavioral task
behavioral1
Sample
Cl1ient-built.exe
Resource
win7-20240419-en
Malware Config
Extracted
quasar
1.4.1
Office04
amount-socket.gl.at.ply.gg:29643
9bda9817-7d07-49e7-92d5-dcaf6b89216c
-
encryption_key
31B6B433E91FDBAAD05B632B163CCF988D67E433
-
install_name
system.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svc
-
subdirectory
SubDir
Targets
-
-
Target
Cl1ient-built.exe
-
Size
3.1MB
-
MD5
00cac0e352ee5c12911f4eb29a34deac
-
SHA1
1bb09225aa309fc793e1eb27faa1ff8b1ccf9e50
-
SHA256
8b5341639e104df91c0dcbd5cec78286fa9b0fae7d19b637f3a11b93b48b655f
-
SHA512
9c7c0b55e794132a0d1a624a4326e33bbeedbac18f3af984cb3f6f81b6e4d534b63de23f027436eb85fdc40c1f4d8ccf1bd991b27e6303b35c975c78a4daa839
-
SSDEEP
49152:PvDI22SsaNYfdPBldt698dBcjHaLPnVjoGdhHTHHB72eh2NT:Pv822SsaNYfdPBldt6+dBcjHaTntx
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-