General
-
Target
TestforKio.exe
-
Size
3.1MB
-
Sample
240629-xxakwsteqc
-
MD5
47058cd2874396c053c1b9d90b987b99
-
SHA1
9bbfa6ee0adfc5df280740906df97b4f45b611fa
-
SHA256
e775b42335e7764a5bf9e695f68272c68fc68de16d20bd3b11af95632edcfc5b
-
SHA512
cc3e5bfa9453880d34d33fa448fd06c2cf50608ad9dbfef59d7cbf46f76bdebc739973155fc3e365a008cd40022a1c1587b04342a95e38203625a24709ac545a
-
SSDEEP
49152:fvnI22SsaNYfdPBldt698dBcjHNxDE/Ayk/JxvoGdJTHHB72eh2NT:fvI22SsaNYfdPBldt6+dBcjHNxzV
Malware Config
Extracted
quasar
1.4.1
zzzz
8.tcp.ngrok.io:18001
116e2822-047d-4b5c-ad10-563148a1a28e
-
encryption_key
C366BC97216329D1909524412E3ECB1EBC575D07
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
TestforKio.exe
-
Size
3.1MB
-
MD5
47058cd2874396c053c1b9d90b987b99
-
SHA1
9bbfa6ee0adfc5df280740906df97b4f45b611fa
-
SHA256
e775b42335e7764a5bf9e695f68272c68fc68de16d20bd3b11af95632edcfc5b
-
SHA512
cc3e5bfa9453880d34d33fa448fd06c2cf50608ad9dbfef59d7cbf46f76bdebc739973155fc3e365a008cd40022a1c1587b04342a95e38203625a24709ac545a
-
SSDEEP
49152:fvnI22SsaNYfdPBldt698dBcjHNxDE/Ayk/JxvoGdJTHHB72eh2NT:fvI22SsaNYfdPBldt6+dBcjHNxzV
-
Quasar payload
-
Legitimate hosting services abused for malware hosting/C2
-