General
-
Target
1188-57-0x0000000000F40000-0x00000000017B6000-memory.dmp
-
Size
8.5MB
-
Sample
230605-r9xcjahc29
-
MD5
3d7637d04a1f65884a3b74ea2bd0e02e
-
SHA1
c0bd76a823b6833529b0f5fe763b88bc29d1b04b
-
SHA256
2bd0dec1705f520f03f94f424dfa847ebbb246c27c2a481ce0de01383a39c0fd
-
SHA512
7b98f3974a08895a5450412de5b1474055bdd6d57c46028fb3b3a20557718759a816b2844818dfc97de34822cec122f940e4c5b3054378f57abaf8b6f5415904
-
SSDEEP
196608:ZXNOHw4YY17oZLyzP5NzQiYLRiV2sKoK:pYIYlfLviRiVrKo
Behavioral task
behavioral1
Sample
1188-57-0x0000000000F40000-0x00000000017B6000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1188-57-0x0000000000F40000-0x00000000017B6000-memory.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
quasar
1.3.0.0
Discord Skids
consider-brochure.at.ply.gg:27804
QSR_MUTEX_K74gPsK0rTir6ohMb6
-
encryption_key
7bQbeRbkWBPbfsQ8OJAh
-
install_name
COM Surrogate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SystemHealthTray
-
subdirectory
SubDir
Targets
-
-
Target
1188-57-0x0000000000F40000-0x00000000017B6000-memory.dmp
-
Size
8.5MB
-
MD5
3d7637d04a1f65884a3b74ea2bd0e02e
-
SHA1
c0bd76a823b6833529b0f5fe763b88bc29d1b04b
-
SHA256
2bd0dec1705f520f03f94f424dfa847ebbb246c27c2a481ce0de01383a39c0fd
-
SHA512
7b98f3974a08895a5450412de5b1474055bdd6d57c46028fb3b3a20557718759a816b2844818dfc97de34822cec122f940e4c5b3054378f57abaf8b6f5415904
-
SSDEEP
196608:ZXNOHw4YY17oZLyzP5NzQiYLRiV2sKoK:pYIYlfLviRiVrKo
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-