General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240701-rd2blswakb
-
MD5
9be969c60df3c2cf819d86fe21c22403
-
SHA1
2a7412bd9979b49ee875592527e5703027ada8b7
-
SHA256
fd9c9c52f6a1f42dbc9bae5cb41f29ab2d13d38a265998669dca294c19502295
-
SHA512
f500a03062360d8b161706a1fec23d1f145152a7214b4f794c1be6202e670ddd747177aada93867b6b2546177d50d00f55f167cf7a806f3e543696c8dcee2b87
-
SSDEEP
49152:CvRt62XlaSFNWPjljiFa2RoUYIE444poGdtTHHB72eh2NT:Cvb62XlaSFNWPjljiFXRoUYI34E
Malware Config
Extracted
quasar
1.4.1
Office04
10.0.2.15:4782
34b824a5-92b1-4778-827a-9a291a182de7
-
encryption_key
9D7A82CA2BF1EE1C2F54E2F44FB5DD27535C300F
-
install_name
Teams.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
9be969c60df3c2cf819d86fe21c22403
-
SHA1
2a7412bd9979b49ee875592527e5703027ada8b7
-
SHA256
fd9c9c52f6a1f42dbc9bae5cb41f29ab2d13d38a265998669dca294c19502295
-
SHA512
f500a03062360d8b161706a1fec23d1f145152a7214b4f794c1be6202e670ddd747177aada93867b6b2546177d50d00f55f167cf7a806f3e543696c8dcee2b87
-
SSDEEP
49152:CvRt62XlaSFNWPjljiFa2RoUYIE444poGdtTHHB72eh2NT:Cvb62XlaSFNWPjljiFXRoUYI34E
-
Quasar payload
-
Executes dropped EXE
-