General
-
Target
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
-
Size
3.1MB
-
Sample
240521-a4664sdb2s
-
MD5
483d0a45f61e108b7a89c6707e138d62
-
SHA1
da16e84ef741a6a82038468da5990b25e3bf751c
-
SHA256
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
-
SHA512
5c6da715cdafda98a37b6eaa455d5c12148b1048f5e038f9482d0f51f5e247cf75ff1c8439d3a75b6f674daa843a8ecd21aab23663b6bdd6bc7bac0fce606492
-
SSDEEP
49152:Wvxt62XlaSFNWPjljiFa2RoUYIiyTCD8foGdIoTHHB72eh2NT:Wv762XlaSFNWPjljiFXRoUYIiyTCc
Behavioral task
behavioral1
Sample
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
quasar
1.4.1
Beamed Celex
192.168.2.102:5145
Nixon:5145
a9d8efa6-449f-415c-bad7-c7fbd83156d2
-
encryption_key
288C4AC276CDC9ADD45AEABDE642A8A88681F7BB
-
install_name
Celex.exe
-
log_directory
Logs
-
reconnect_delay
1
-
startup_key
Celex
-
subdirectory
Celex
Targets
-
-
Target
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
-
Size
3.1MB
-
MD5
483d0a45f61e108b7a89c6707e138d62
-
SHA1
da16e84ef741a6a82038468da5990b25e3bf751c
-
SHA256
34bb0abcb4e25933c6c2317944d183e40a25175f808c990b59b49fb2b0448c40
-
SHA512
5c6da715cdafda98a37b6eaa455d5c12148b1048f5e038f9482d0f51f5e247cf75ff1c8439d3a75b6f674daa843a8ecd21aab23663b6bdd6bc7bac0fce606492
-
SSDEEP
49152:Wvxt62XlaSFNWPjljiFa2RoUYIiyTCD8foGdIoTHHB72eh2NT:Wv762XlaSFNWPjljiFXRoUYIiyTCc
Score10/10-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-