General
-
Target
recent.rar
-
Size
1.0MB
-
Sample
240701-3d8w8swfpe
-
MD5
765cbac6d98a3236488b54248f9a02c7
-
SHA1
7e8941a589b2c8569b2102492c8822960aa050d5
-
SHA256
c7f980788ffdcaef1b5135978332bc45bfe8e90c3462365bed7e219f3b0402fa
-
SHA512
ea3a347814515625c56f5cb1a686f81ae1f66489083bd5608e2fc4364cdac88dd6535c9166255f9457e003e17a6d402c3a47ab8f424d37ea46a1c4ab7e55c8e4
-
SSDEEP
24576:4XGGsvsPAGw3I32Hx/jGjFA4z8SyzR3PP1lvtVV3L0O:xzsjw3I3g9y53zNyR9lvtVV3L0O
Behavioral task
behavioral1
Sample
recent.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
recent.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
quasar
1.4.1
Spoofer
Voltei-24086.portmap.host:24086
0b2f1257-73e5-4bd8-8e6a-c2d4b72b9569
-
encryption_key
BAA9862FBD462AD8D3AD01C72E5D5485C8E30CC3
-
install_name
svchost.exe
-
log_directory
Bonjour
-
reconnect_delay
3000
-
startup_key
conhost
-
subdirectory
windows
Targets
-
-
Target
recent.exe
-
Size
3.1MB
-
MD5
9cbb9436ad04c7430b8a31aecd3e0fc1
-
SHA1
e4cf4e483067bb95e33f82e5447542c61770e2cc
-
SHA256
a158f6e01452f25113d80967562d9494bcfab3bd687af1756ab4c067b59f1a84
-
SHA512
5afb2948608147c965cda4127465dbfd7750865758a7dc11cc0c65d7dfb996185715688b6538d100faeb4a18f2db276206b0399300aead090b37b1abb2dfcba4
-
SSDEEP
49152:mvmI22SsaNYfdPBldt698dBcjHO2RJ6GbR3LoGdKfTHHB72eh2NT:mvr22SsaNYfdPBldt6+dBcjHO2RJ6A6
-
Quasar payload
-
Executes dropped EXE
-