General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240630-vbbjysthkp
-
MD5
4f56c5c10fd6d558874a09e5d4dbdffd
-
SHA1
5b9692b0cfc0da65752a7c6e98528a49ef1b17b9
-
SHA256
0a1af9ad6684d877f7c58b00bec90875ccfd709f547fe396a87a9c26e881977b
-
SHA512
699ff682370ee44a41af76686435f41682910d1291fbe159570f51e1aed05331dfce20074b3d5cd5937dfe6a8db651f8a4f320b4bf2fe2f38d585b8d4b95c8b4
-
SSDEEP
49152:GvnI22SsaNYfdPBldt698dBcjHnKmmmmzzRoGdJCTHHB72eh2NT:GvI22SsaNYfdPBldt6+dBcjHKmmh
Malware Config
Extracted
quasar
1.4.1
Office04
86.137.1.84:4782
adc301f6-35ca-4636-b286-ad2aef63f877
-
encryption_key
54B7AB1A151267275EF24D335CE7E3B6ABDDC53E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Launcher Task Manager
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4f56c5c10fd6d558874a09e5d4dbdffd
-
SHA1
5b9692b0cfc0da65752a7c6e98528a49ef1b17b9
-
SHA256
0a1af9ad6684d877f7c58b00bec90875ccfd709f547fe396a87a9c26e881977b
-
SHA512
699ff682370ee44a41af76686435f41682910d1291fbe159570f51e1aed05331dfce20074b3d5cd5937dfe6a8db651f8a4f320b4bf2fe2f38d585b8d4b95c8b4
-
SSDEEP
49152:GvnI22SsaNYfdPBldt698dBcjHnKmmmmzzRoGdJCTHHB72eh2NT:GvI22SsaNYfdPBldt6+dBcjHKmmh
-
Quasar payload
-
Executes dropped EXE
-