General
-
Target
Fanta_Is_Better_Than_Coke.bat
-
Size
577KB
-
Sample
240702-rwekka1djl
-
MD5
a2abc2cdceded8a9c4a3b92243dea264
-
SHA1
7884604d8abd0406ecd8123309f87c419e92220d
-
SHA256
36f37bb5d126c79c977e6e2a0707d67e722b0d623aa708b6429b1a293c3a1614
-
SHA512
d57eb2bc465b3451ce51fd44d9f2cf71780cf71e93a45df8ff52dcc1c6ca50067991d99fa74b72cc40701b5a9ac8a4b630e5cca33bbec216819ecfc57b2eef02
-
SSDEEP
12288:SGZlCP14WSSirkOxYSjLwZcbuoleaLP8J69Z1GR/9D7dg6KuH2:JSPGW+564Ltuonp1YDhW
Static task
static1
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
xworm
super-nearest.gl.at.ply.gg:17835
best-bird.gl.at.ply.gg:27196
wiz.bounceme.net:6000
Extracted
asyncrat
Default
finally-grande.gl.at.ply.gg:25844
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
quasar
3.1.5
Slave
stop-largely.gl.at.ply.gg:27116
$Sxr-kl1r656AGsPQksTmi8
-
encryption_key
CjDCAPF1JiLswgFipef3
-
install_name
$77Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Start-Up Application
-
subdirectory
$77
Targets
-
-
Target
Fanta_Is_Better_Than_Coke.bat
-
Size
577KB
-
MD5
a2abc2cdceded8a9c4a3b92243dea264
-
SHA1
7884604d8abd0406ecd8123309f87c419e92220d
-
SHA256
36f37bb5d126c79c977e6e2a0707d67e722b0d623aa708b6429b1a293c3a1614
-
SHA512
d57eb2bc465b3451ce51fd44d9f2cf71780cf71e93a45df8ff52dcc1c6ca50067991d99fa74b72cc40701b5a9ac8a4b630e5cca33bbec216819ecfc57b2eef02
-
SSDEEP
12288:SGZlCP14WSSirkOxYSjLwZcbuoleaLP8J69Z1GR/9D7dg6KuH2:JSPGW+564Ltuonp1YDhW
-
Detect Xworm Payload
-
Quasar payload
-
Async RAT payload
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-