General
-
Target
sxr-powershell.exe
-
Size
413KB
-
Sample
240429-wy7fkshc54
-
MD5
16ca1837307fc5854e157b074187c45f
-
SHA1
aceab2cc8b9e04a98a3833cc5958df313621a95d
-
SHA256
64ab43839c061a483d72f1ec01ab8488e482283014de88887937befe3abcb971
-
SHA512
f32c203b0cdc9fc77378289708fcf8a2149ddc11258617b5482f005f56fa7e1c7d23c29c8a7c2fd2f184644dcd68ef8c8409fe1b4e4fda3f7a0f564b8175c8ef
-
SSDEEP
6144:RNmEjkzQT1TVN9Dnc2b+VyPX489mbjIbLGYXr3tMfpDsXZ/Dbf/m/cjqOGa:31TVVMq+4PX488kLPXz2pDGXfUcjxGa
Malware Config
Extracted
quasar
3.1.5
Office04
147.185.221.19:33587
$Sxr-h0ICVjHNrcHhzPpdBF
-
encryption_key
5AYOUFuXYMmH4RkMAuQz
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-powershell
-
reconnect_delay
3000
-
startup_key
$sxr-metsha
-
subdirectory
sxr
Targets
-
-
Target
sxr-powershell.exe
-
Size
413KB
-
MD5
16ca1837307fc5854e157b074187c45f
-
SHA1
aceab2cc8b9e04a98a3833cc5958df313621a95d
-
SHA256
64ab43839c061a483d72f1ec01ab8488e482283014de88887937befe3abcb971
-
SHA512
f32c203b0cdc9fc77378289708fcf8a2149ddc11258617b5482f005f56fa7e1c7d23c29c8a7c2fd2f184644dcd68ef8c8409fe1b4e4fda3f7a0f564b8175c8ef
-
SSDEEP
6144:RNmEjkzQT1TVN9Dnc2b+VyPX489mbjIbLGYXr3tMfpDsXZ/Dbf/m/cjqOGa:31TVVMq+4PX488kLPXz2pDGXfUcjxGa
-
Quasar payload
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-