General
-
Target
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a
-
Size
2.7MB
-
Sample
220924-2bed6sdefq
-
MD5
181fdf4b2fd548b5563d1d34dfb7b691
-
SHA1
d60221a413122368890fb1d3dbd9cb3980e41104
-
SHA256
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a
-
SHA512
b45dad9e0c80b803733c376efc1241f745dde4c706af4059611f1143dfe8e368aa7ffdd298b053f3b529cc3a317d875bca40b79ac8f901d6d74e9297b8ac6e8b
-
SSDEEP
49152:DqusQxWfZ0IP92v9SQDNVK6aT0H0jvfVb5idvYSwYp6IzZAU+XoGgGT80HrQ:eOWfZhw9PJ06aTdjfV4vYSwQ6+mUZ2wD
Static task
static1
Behavioral task
behavioral1
Sample
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a.exe
Resource
win10-20220812-en
Malware Config
Extracted
quasar
2.7.0.0
Venom Client
probka.ddns.net:4545
JlYM51eW4iZoFyLa2X
-
encryption_key
nygFK3eRf9rpU1TEw9ld
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Targets
-
-
Target
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a
-
Size
2.7MB
-
MD5
181fdf4b2fd548b5563d1d34dfb7b691
-
SHA1
d60221a413122368890fb1d3dbd9cb3980e41104
-
SHA256
b8cfdd16f5bc4d13a805fe0fbc11fc0e569cd7e5d9b84255739baaceb3c3fe5a
-
SHA512
b45dad9e0c80b803733c376efc1241f745dde4c706af4059611f1143dfe8e368aa7ffdd298b053f3b529cc3a317d875bca40b79ac8f901d6d74e9297b8ac6e8b
-
SSDEEP
49152:DqusQxWfZ0IP92v9SQDNVK6aT0H0jvfVb5idvYSwYp6IzZAU+XoGgGT80HrQ:eOWfZhw9PJ06aTdjfV4vYSwQ6+mUZ2wD
Score10/10-
Quasar payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-