General
-
Target
Uni.bat
-
Size
527KB
-
Sample
240707-zn76xayajp
-
MD5
062c43d35d03da1e0a58a12e57651608
-
SHA1
3e9d391f92764ad0fd03c892519254c5de3dcc89
-
SHA256
e7d47c72c1234e87caf21fe4a554167d51d55983118d0de27bd42c66b6337334
-
SHA512
cbbe134bc26426904e8cc6780766bf3cbfbff270348ea09e321e79b7a1c6c3162eec093291fbb76e922baff0f8f46386f9bb4789245334449cf058f35d9834bb
-
SSDEEP
12288:2UcgbOIma9M8BbH1ZcoXdX+FBPCu1brE8tVu:2ZMOImsMuu4FKNCu1bJu
Static task
static1
Behavioral task
behavioral1
Sample
Uni.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.bat
Resource
win10v2004-20240704-en
Malware Config
Extracted
quasar
1.3.0.0
Office04
147.185.221.20:49485
QSR_MUTEX_JvE0XZSeRt4R9Jub02
-
encryption_key
j1TnPb2vAEtvscjiBoXh
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Targets
-
-
Target
Uni.bat
-
Size
527KB
-
MD5
062c43d35d03da1e0a58a12e57651608
-
SHA1
3e9d391f92764ad0fd03c892519254c5de3dcc89
-
SHA256
e7d47c72c1234e87caf21fe4a554167d51d55983118d0de27bd42c66b6337334
-
SHA512
cbbe134bc26426904e8cc6780766bf3cbfbff270348ea09e321e79b7a1c6c3162eec093291fbb76e922baff0f8f46386f9bb4789245334449cf058f35d9834bb
-
SSDEEP
12288:2UcgbOIma9M8BbH1ZcoXdX+FBPCu1brE8tVu:2ZMOImsMuu4FKNCu1bJu
-
Quasar payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-