General
-
Target
Fanta_Is_Better_Than_Coke.bat
-
Size
572KB
-
Sample
240702-rnn42awepe
-
MD5
a6abba5749f044addb0845034edcdec0
-
SHA1
39fd59d6ac9e42d4ee537bc11fb3bbd68fa948cc
-
SHA256
f5e3eeb202a2a352fdcbab83ba823abf8b01abfbd7aeefb511ea6c310e281d11
-
SHA512
c260dd311e0eeb59a7969dce91d095ab0dd18a4bfea20698dd9b61f70b9c356157e26372ed83f83e9412dbeef714c3f367e0e10775820b64d13aaa5bd1dc84b6
-
SSDEEP
12288:JGZlCP14WSSirkOxYSjLwZcbuoleaLP8J69Z1GR/9D7dg6KuH2:0SPGW+564Ltuonp1YDhW
Static task
static1
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
xworm
super-nearest.gl.at.ply.gg:17835
best-bird.gl.at.ply.gg:27196
wiz.bounceme.net:6000
Extracted
asyncrat
Default
finally-grande.gl.at.ply.gg:25844
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
quasar
3.1.5
Slave
stop-largely.gl.at.ply.gg:27116
$Sxr-kl1r656AGsPQksTmi8
-
encryption_key
CjDCAPF1JiLswgFipef3
-
install_name
$77Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Start-Up Application
-
subdirectory
$77
Targets
-
-
Target
Fanta_Is_Better_Than_Coke.bat
-
Size
572KB
-
MD5
a6abba5749f044addb0845034edcdec0
-
SHA1
39fd59d6ac9e42d4ee537bc11fb3bbd68fa948cc
-
SHA256
f5e3eeb202a2a352fdcbab83ba823abf8b01abfbd7aeefb511ea6c310e281d11
-
SHA512
c260dd311e0eeb59a7969dce91d095ab0dd18a4bfea20698dd9b61f70b9c356157e26372ed83f83e9412dbeef714c3f367e0e10775820b64d13aaa5bd1dc84b6
-
SSDEEP
12288:JGZlCP14WSSirkOxYSjLwZcbuoleaLP8J69Z1GR/9D7dg6KuH2:0SPGW+564Ltuonp1YDhW
-
Detect Xworm Payload
-
Quasar payload
-
Async RAT payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-