General
-
Target
tmp
-
Size
6.7MB
-
Sample
230325-rjb9nsda74
-
MD5
82792ba7124ecaa06893c3a6989bc70a
-
SHA1
c7caa0f4f696e38f4adb20a3efa2334f8a18675c
-
SHA256
7a6d23d9845bb08f5f50a89a909fc5dfc865cb77a9e44f370b56fd22d7a7f74f
-
SHA512
907d19656886883c6c4fe10657bef9d7380be3b7c16a23d448924d33577df8f552e6c4feca379bbf14bfc4d5c390114e8ad84965bb03d97d0cad5a046371e9b0
-
SSDEEP
196608:SdpVzj3zsdu95DsmQDzgnxUd9B0IETkQHXrjAYaUxHfl:eVzjjsdAsNzt9OIETkSXrj9txHfl
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Malware Config
Extracted
quasar
1.3.0.0
HEU_A
hacker.548848.xyz:4000
QSR_MUTEX_y7qRPJXwrKoCCGjifB
-
encryption_key
zOtqF7XIGfeSwK3tze2l
-
install_name
IntelServiceUpdate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Intel Service Update
-
subdirectory
IntelServiceUpdate
Extracted
quasar
1.3.0.0
HEU_T
81.68.120.79:4000
QSR_MUTEX_kWiUJRAFspPTbob5of
-
encryption_key
7GHKJ6ZgFY9nVhHS7b4U
-
install_name
IntelService.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Intel Service
-
subdirectory
IntelService
Targets
-
-
Target
tmp
-
Size
6.7MB
-
MD5
82792ba7124ecaa06893c3a6989bc70a
-
SHA1
c7caa0f4f696e38f4adb20a3efa2334f8a18675c
-
SHA256
7a6d23d9845bb08f5f50a89a909fc5dfc865cb77a9e44f370b56fd22d7a7f74f
-
SHA512
907d19656886883c6c4fe10657bef9d7380be3b7c16a23d448924d33577df8f552e6c4feca379bbf14bfc4d5c390114e8ad84965bb03d97d0cad5a046371e9b0
-
SSDEEP
196608:SdpVzj3zsdu95DsmQDzgnxUd9B0IETkQHXrjAYaUxHfl:eVzjjsdAsNzt9OIETkSXrj9txHfl
-
Quasar payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-