General
-
Target
SecurityHealthSystray.exe
-
Size
353KB
-
Sample
230605-bb3tnaed46
-
MD5
7a9add7e6f6fa0bd8df9a7ec2b8cfb2a
-
SHA1
011c64eb4445b1b2e5a4bebcd0aa72e993497e73
-
SHA256
ee8fe0d59eccb5a8eb288a57e6aea41dc2e5e4c95a25a434fd5e08155f321ea7
-
SHA512
0702f304f3bbc9a45111dd3069c9799176a8ecc5d97351fddd55f01b472e095602c72e8db813b1ee93017fb122aee2f4670288227a0cf4d7e6f1b6d6ea6c19ac
-
SSDEEP
6144:OuIDkAT6QSkszJqfj5D4dasv6ursybbIQyeZgoCR85fR7SwXnM:t6iksqDwYUPn5fRS8M
Behavioral task
behavioral1
Sample
SecurityHealthSystray.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SecurityHealthSystray.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
quasar
1.3.0.0
Discord Retards
consider-brochure.at.ply.gg:27804
QSR_MUTEX_yEihaOvZEzneMMUBSr
-
encryption_key
X5HxVSWdjmOnUtl2t2X8
-
install_name
SercurityHealthSystray.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SecurityHealthSystray
-
subdirectory
SubDir
Targets
-
-
Target
SecurityHealthSystray.exe
-
Size
353KB
-
MD5
7a9add7e6f6fa0bd8df9a7ec2b8cfb2a
-
SHA1
011c64eb4445b1b2e5a4bebcd0aa72e993497e73
-
SHA256
ee8fe0d59eccb5a8eb288a57e6aea41dc2e5e4c95a25a434fd5e08155f321ea7
-
SHA512
0702f304f3bbc9a45111dd3069c9799176a8ecc5d97351fddd55f01b472e095602c72e8db813b1ee93017fb122aee2f4670288227a0cf4d7e6f1b6d6ea6c19ac
-
SSDEEP
6144:OuIDkAT6QSkszJqfj5D4dasv6ursybbIQyeZgoCR85fR7SwXnM:t6iksqDwYUPn5fRS8M
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-