General
-
Target
Uni.exe
-
Size
348KB
-
Sample
240702-wajdvatgjc
-
MD5
d98814e594224fa06fb9bf4fbfc6ee90
-
SHA1
db74c6e773f5575b9b4b05ae206c21827f9bae57
-
SHA256
85a3c4d50a0e17ddc581206e4ac1a2f1220c16d562d6e894f5068972159ddca0
-
SHA512
3436b3f7c6dc4c7696ccc4d4efaebd9cada8f4d2ee9b711bbe523e26813919fb58a265ea3f3195c45dde3930f2995fc1951e387eab7437198ce060b97fce96ee
-
SSDEEP
6144:UzL3HRsM+OFZcZt3bfTGksNFbp1xzpCSgJuzKkgfzT:CVP+MMsNh97gJuzKkWzT
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
quasar
15.5.0
SeroXen
paris-itself.gl.at.ply.gg:49485
QSR_MUTEX_9sjCnkSDYeXTl5L2qC
-
encryption_key
jKIJSX0QMuirSu2Asapm
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Taskmgr
-
subdirectory
$sxr-seroxen2
Targets
-
-
Target
Uni.exe
-
Size
348KB
-
MD5
d98814e594224fa06fb9bf4fbfc6ee90
-
SHA1
db74c6e773f5575b9b4b05ae206c21827f9bae57
-
SHA256
85a3c4d50a0e17ddc581206e4ac1a2f1220c16d562d6e894f5068972159ddca0
-
SHA512
3436b3f7c6dc4c7696ccc4d4efaebd9cada8f4d2ee9b711bbe523e26813919fb58a265ea3f3195c45dde3930f2995fc1951e387eab7437198ce060b97fce96ee
-
SSDEEP
6144:UzL3HRsM+OFZcZt3bfTGksNFbp1xzpCSgJuzKkgfzT:CVP+MMsNh97gJuzKkWzT
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-