General
-
Target
aabb.exe
-
Size
3.1MB
-
Sample
231222-3e4c5sdfen
-
MD5
8295dfdc857537c3ecf20b85aae299cc
-
SHA1
3a0afcd9e6717d9485eef03b0f025dbac1f36891
-
SHA256
644b2903e1c8b5d6b63335e409b1d624e1bdf620de4bacab2d54c0bef69e5dae
-
SHA512
6fb6c4d7b122d5c7eb1f05ed938020589c093db5cbae0addcc4c274f383057155aa1f6e9c85840f1a3a3f5fb0996cbfade6f4a124889e105e32cbf194c046936
-
SSDEEP
49152:DvcG42pda6D+/PjlLOlg6yQipV/x0qb6jv04Loyd2iTHHB72eh2NT:Dvn42pda6D+/PjlLOlZyQipVb6z
Malware Config
Extracted
quasar
1.4.1
Office04
0.tcp.eu.ngrok.io:15683
tcp.kochambeton.pl:1337
99a331b1-13b5-4e73-be8f-b5c19bd595ef
-
encryption_key
E31FE4ECA57A8B089443D8B26651DAD7DB7A12F8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Counter Strike Global Offensive
-
subdirectory
SubDir
Targets
-
-
Target
aabb.exe
-
Size
3.1MB
-
MD5
8295dfdc857537c3ecf20b85aae299cc
-
SHA1
3a0afcd9e6717d9485eef03b0f025dbac1f36891
-
SHA256
644b2903e1c8b5d6b63335e409b1d624e1bdf620de4bacab2d54c0bef69e5dae
-
SHA512
6fb6c4d7b122d5c7eb1f05ed938020589c093db5cbae0addcc4c274f383057155aa1f6e9c85840f1a3a3f5fb0996cbfade6f4a124889e105e32cbf194c046936
-
SSDEEP
49152:DvcG42pda6D+/PjlLOlg6yQipV/x0qb6jv04Loyd2iTHHB72eh2NT:Dvn42pda6D+/PjlLOlZyQipVb6z
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-