General
-
Target
massdm.exe
-
Size
3.1MB
-
Sample
240707-kbvygsxgjp
-
MD5
04e3fc47229c8a8698ec9e3cd5c4b829
-
SHA1
48c51cc0e2ddaf67b946b5a7072d8dfda1ac2f9b
-
SHA256
2ada2c30d9f8899b676ee45a4f3ebfcf143d8b21b332a8d9fda0b4168c1d1abe
-
SHA512
ea946ac34599b4dac4fe268c66fe10ba400f6cb96789d699e434461a48c9e00d6e59263e055b56eb7c5becd513f57e7eefdc168568bfce30ba018bdffa77bdbb
-
SSDEEP
49152:WvXG42pda6D+/PjlLOlg6yQipVQX73ElxXk/GTLoGdATHHB72eh2NT:Wv242pda6D+/PjlLOlZyQipV07if
Behavioral task
behavioral1
Sample
massdm.exe
Resource
win7-20240221-en
Malware Config
Extracted
quasar
1.4.1
massdm
192.168.12.170:4782
national-sell.gl.at.ply.gg:64271
147.185.221.20:64271
5eb3f791-a6e9-4271-bd57-f36e030f282b
-
encryption_key
823D3CEACC9A45CF45C22F13CE6E454A3272B650
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
massdm.exe
-
Size
3.1MB
-
MD5
04e3fc47229c8a8698ec9e3cd5c4b829
-
SHA1
48c51cc0e2ddaf67b946b5a7072d8dfda1ac2f9b
-
SHA256
2ada2c30d9f8899b676ee45a4f3ebfcf143d8b21b332a8d9fda0b4168c1d1abe
-
SHA512
ea946ac34599b4dac4fe268c66fe10ba400f6cb96789d699e434461a48c9e00d6e59263e055b56eb7c5becd513f57e7eefdc168568bfce30ba018bdffa77bdbb
-
SSDEEP
49152:WvXG42pda6D+/PjlLOlg6yQipVQX73ElxXk/GTLoGdATHHB72eh2NT:Wv242pda6D+/PjlLOlZyQipV07if
-
Quasar payload
-
Executes dropped EXE
-