General
-
Target
R0X-Built.exe
-
Size
409KB
-
Sample
240510-hppyaacd79
-
MD5
6755a8034c245ebe11816c1e80286929
-
SHA1
b620053be1ac5845f10cec36a1072ed6b6e116f8
-
SHA256
b26ec4d47dac00d294fe2b327c0f02d6b9c3ba14819ace77d972557640f1105e
-
SHA512
96307fd18ab07df983d3c05c8354a0414888a01bea0a2d80d68a42ee6e8275acceaae3b709d9684a8b8945e8cbbff5eb71907d5eb329c8d9074c29f6d66ca7b8
-
SSDEEP
12288:3piREGJfR9EqRg//vo3s6z06l/ao7nhvum9Aq:ZwpJdNFCo7hR
Malware Config
Extracted
quasar
3.1.5
Slave
looking-memphis.gl.at.ply.gg:45119
$Sxr-3vDee7FzoJnhqjuE3n
-
encryption_key
bjv1MgUogo1kl6Tra7jd
-
install_name
$srr-powershell.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
$srr-powershell
-
subdirectory
Windows
Targets
-
-
Target
R0X-Built.exe
-
Size
409KB
-
MD5
6755a8034c245ebe11816c1e80286929
-
SHA1
b620053be1ac5845f10cec36a1072ed6b6e116f8
-
SHA256
b26ec4d47dac00d294fe2b327c0f02d6b9c3ba14819ace77d972557640f1105e
-
SHA512
96307fd18ab07df983d3c05c8354a0414888a01bea0a2d80d68a42ee6e8275acceaae3b709d9684a8b8945e8cbbff5eb71907d5eb329c8d9074c29f6d66ca7b8
-
SSDEEP
12288:3piREGJfR9EqRg//vo3s6z06l/ao7nhvum9Aq:ZwpJdNFCo7hR
-
Quasar payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-