General
-
Target
808d880b4fc7f865fb607337690b5575.bin
-
Size
220KB
-
Sample
240630-c5evcswdpk
-
MD5
42cda68d37afda19e294d85fc4e57777
-
SHA1
cec30df8624a5b0156ec17a77fda03df5027e99d
-
SHA256
5eec17c4ce22389c5ce80baca010f903a74758458f91d0a5a269b1df4811fa1b
-
SHA512
5bbc61f4249eb4b1044560233845939860dec3519433d534b312e997821050deeabaac13c9f2de473b7def2400d59e373e5ed018d714b4c01bc27e09902b8393
-
SSDEEP
3072:vNMmqE4rVNStZzKpvtIMU3cSLkHxI1RSTWcQUymPrnYCfjme/MA4jvP0hpt3D9:vw/A3cCmxI1cXymOeEjwhptB
Behavioral task
behavioral1
Sample
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe
Resource
win7-20240508-en
Malware Config
Extracted
quasar
3.1.5
SeroXen
feel-barcelona.gl.at.ply.gg:47655
$Sxr-GV6wZsGZZMeZ3qfenc
-
encryption_key
OyypB9RDbCUrmPK8uTim
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Anti-Malware Disable Startup
-
subdirectory
SubDir
Targets
-
-
Target
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962.exe
-
Size
409KB
-
MD5
808d880b4fc7f865fb607337690b5575
-
SHA1
7782ec3da7a6f8ed196d4431c59d50690580ac39
-
SHA256
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962
-
SHA512
7a7ee833835d9469a1a5b48a5cbf9c902f362d82ad37b2ba99944e692b4322c140d770dc7be30f8ace7b84d6508e4d2e5f2007294ca3c07094bbfca8120ec6a8
-
SSDEEP
12288:KpsD64e1Muxkk3abqow6dL+32oJN/nSjCt1hw:OsG4kMUQU6E3NN/nk
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-