General
-
Target
sp0ofer.exe
-
Size
3.1MB
-
Sample
240629-2sdtzasarl
-
MD5
c5dc60ebad720c8a08e21c08db1d2dfa
-
SHA1
268f1aace8a48248d58de344bd1dfd2eb5e2c2a8
-
SHA256
cbac5d6488d2b1655aff14f498060b3a0f752bc26291a34c39ff76da2866de9a
-
SHA512
9930d8208b8bba24bd0d70d9491a302c8efefea5ff195711eee0f725f39b83070e624474de990cd0dc14c80ba0bd27a343cfc31fcee4104e49a76e637cd829f7
-
SSDEEP
49152:DvulL26AaNeWgPhlmVqvMQ7XSKPPxNESEfk/ioLoGdfxTHHB72eh2NT:DveL26AaNeWgPhlmVqkQ7XSKHxCG
Behavioral task
behavioral1
Sample
sp0ofer.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
Office04
pringelsy-53072.portmap.host:53072
6dc28d35-3024-44a7-a559-f9991015fa39
-
encryption_key
3107DF2D44BB6914C55BEA57D100135AB0F278DF
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
799
-
startup_key
Quasar Client Startup
-
subdirectory
Common Files
Targets
-
-
Target
sp0ofer.exe
-
Size
3.1MB
-
MD5
c5dc60ebad720c8a08e21c08db1d2dfa
-
SHA1
268f1aace8a48248d58de344bd1dfd2eb5e2c2a8
-
SHA256
cbac5d6488d2b1655aff14f498060b3a0f752bc26291a34c39ff76da2866de9a
-
SHA512
9930d8208b8bba24bd0d70d9491a302c8efefea5ff195711eee0f725f39b83070e624474de990cd0dc14c80ba0bd27a343cfc31fcee4104e49a76e637cd829f7
-
SSDEEP
49152:DvulL26AaNeWgPhlmVqvMQ7XSKPPxNESEfk/ioLoGdfxTHHB72eh2NT:DveL26AaNeWgPhlmVqkQ7XSKHxCG
-
Quasar payload
-
Executes dropped EXE
-