General
-
Target
buff.exe
-
Size
3.1MB
-
Sample
240707-kvbnys1akd
-
MD5
b4331fcabc3c2d49951fae44870ebe91
-
SHA1
6998f4c7c6f2306f4245e59ce3d8bc5fc13bf94f
-
SHA256
3a05452acbb8d384d59428cb8194fb760e5de23ef581a07f168ff840d8e2fea9
-
SHA512
1de347b19d4a7187df2ffd8d141d5a363aabcf2425b66b482a6fed7133a805e6ab7d6064f29100f83725f0e2e2394da592fbffb574752db015f58206202b007b
-
SSDEEP
49152:WvXG42pda6D+/PjlLOlg6yQipVKwRJ6hbR3LoGdGCITHHB72eh2NT:Wv242pda6D+/PjlLOlZyQipVKwRJ6D2
Behavioral task
behavioral1
Sample
buff.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
massdm
192.168.1.156:4782
r-minolta.gl.at.ply.gg:63431
7a0df206-428b-4b7b-939a-21fd6eb0a342
-
encryption_key
EB77EF1E2C1E9FC0CC580EBFBB1E68F8B012F37E
-
install_name
massdm.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
buff.exe
-
Size
3.1MB
-
MD5
b4331fcabc3c2d49951fae44870ebe91
-
SHA1
6998f4c7c6f2306f4245e59ce3d8bc5fc13bf94f
-
SHA256
3a05452acbb8d384d59428cb8194fb760e5de23ef581a07f168ff840d8e2fea9
-
SHA512
1de347b19d4a7187df2ffd8d141d5a363aabcf2425b66b482a6fed7133a805e6ab7d6064f29100f83725f0e2e2394da592fbffb574752db015f58206202b007b
-
SSDEEP
49152:WvXG42pda6D+/PjlLOlg6yQipVKwRJ6hbR3LoGdGCITHHB72eh2NT:Wv242pda6D+/PjlLOlZyQipVKwRJ6D2
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-