General
-
Target
8a0a8b83da8dbe8dfb6dae64556d39d7.bin
-
Size
3.1MB
-
Sample
240313-b8nq1abb65
-
MD5
8a0a8b83da8dbe8dfb6dae64556d39d7
-
SHA1
d3dd4e87ea883b4084240b923f2f80c9aadfed14
-
SHA256
eb46d0e15cd35a1864d8937e2d4df8943db939ee477e9966abe21697c5cd15bf
-
SHA512
6b268804a5811dfaa4476b40097c7edab76484859ac2fdfa387d94ee78ac9d9998da9eb5163495085e16ccf60f1842a895cc4c58be3faae5a5241631ad9863c7
-
SSDEEP
49152:/vRuf2NUaNmwzPWlvdaKM7ZxTwD3RJ6CbR3LoGdjQxTHHB72eh2NT:/vsf2NUaNmwzPWlvdaB7ZxTwD3RJ68
Behavioral task
behavioral1
Sample
8a0a8b83da8dbe8dfb6dae64556d39d7.exe
Resource
win7-20240215-en
Malware Config
Extracted
quasar
1.4.1
GetRatted
uk2.localto.net:443
uk2.localto.net:32941
uk2.localto.net:4782
994c2285-849b-4fdc-b619-27d9587c3b49
-
encryption_key
7AE765C52213CCEA26FAE79A12777B2DAB755385
-
install_name
Minecraft.exe
-
log_directory
Steam WebHelper
-
reconnect_delay
3000
-
startup_key
Steam WebHelper
-
subdirectory
SubDir
Targets
-
-
Target
8a0a8b83da8dbe8dfb6dae64556d39d7.bin
-
Size
3.1MB
-
MD5
8a0a8b83da8dbe8dfb6dae64556d39d7
-
SHA1
d3dd4e87ea883b4084240b923f2f80c9aadfed14
-
SHA256
eb46d0e15cd35a1864d8937e2d4df8943db939ee477e9966abe21697c5cd15bf
-
SHA512
6b268804a5811dfaa4476b40097c7edab76484859ac2fdfa387d94ee78ac9d9998da9eb5163495085e16ccf60f1842a895cc4c58be3faae5a5241631ad9863c7
-
SSDEEP
49152:/vRuf2NUaNmwzPWlvdaKM7ZxTwD3RJ6CbR3LoGdjQxTHHB72eh2NT:/vsf2NUaNmwzPWlvdaB7ZxTwD3RJ68
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-