General
-
Target
sp00fer.exe
-
Size
3.1MB
-
Sample
240629-zllj5awbrd
-
MD5
a83e969ffc192231f2690fab578e9767
-
SHA1
c18087b36c233437d9357cb5a9ff4317ac0060ec
-
SHA256
98434fe3c17f66fea234631199b6ba3c4b472b52fbcf66b2f0329866b08fd797
-
SHA512
eb004be33eae8ec01cf1a279c06a3288b0a5be568586d92a93bfecd2a81429398a2e7524e3a2400976a836bb40f45650e6f4bd49cececb8bf987467d22248770
-
SSDEEP
49152:HvOlL26AaNeWgPhlmVqvMQ7XSKxeRJ6qbR3LoGdtzrTHHB72eh2NT:Hv+L26AaNeWgPhlmVqkQ7XSKxeRJ6E9
Malware Config
Extracted
quasar
1.4.1
Office04
pringelsy-36149.portmap.host:36149
63621aac-ae17-49da-9413-459827e68061
-
encryption_key
4F2985A1DF21C9CA0E34D9186E1BC62AF4B58C14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
sp00fer.exe
-
Size
3.1MB
-
MD5
a83e969ffc192231f2690fab578e9767
-
SHA1
c18087b36c233437d9357cb5a9ff4317ac0060ec
-
SHA256
98434fe3c17f66fea234631199b6ba3c4b472b52fbcf66b2f0329866b08fd797
-
SHA512
eb004be33eae8ec01cf1a279c06a3288b0a5be568586d92a93bfecd2a81429398a2e7524e3a2400976a836bb40f45650e6f4bd49cececb8bf987467d22248770
-
SSDEEP
49152:HvOlL26AaNeWgPhlmVqvMQ7XSKxeRJ6qbR3LoGdtzrTHHB72eh2NT:Hv+L26AaNeWgPhlmVqkQ7XSKxeRJ6E9
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-