General
-
Target
Uni.exe
-
Size
409KB
-
Sample
240521-kebc9aef52
-
MD5
7544e8e688461810abd5387160692c95
-
SHA1
bb41e11803d0da2fb7f6e2068220ddd3faf347c7
-
SHA256
6da2005775980d44d0a6f9d8f12d7394e8d81abf96f444a6c4da54c2376430a0
-
SHA512
09ffe73cc108762af47e68fb9f72ab37051cda10aec048cd9cb86c65c68696622bd7e24c12b0c07ebc2e8a0620865fc9a35b2ef34d48c3d8522d57cd672ec287
-
SSDEEP
6144:MMfPp5S6M1Xy0gmfnF8V0dguFJSSvbaU01T/yUhAd5GbdQNJ:Bpg6M1i9mfnFUEgctoLILGbdQf
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
quasar
3.1.5
SeroXen
panel-slave.gl.at.ply.gg:57059
$Sxr-rpL8EItHN3pqIQQVy2
-
encryption_key
p81Z0Zy4AcToBvsDk4Li
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Targets
-
-
Target
Uni.exe
-
Size
409KB
-
MD5
7544e8e688461810abd5387160692c95
-
SHA1
bb41e11803d0da2fb7f6e2068220ddd3faf347c7
-
SHA256
6da2005775980d44d0a6f9d8f12d7394e8d81abf96f444a6c4da54c2376430a0
-
SHA512
09ffe73cc108762af47e68fb9f72ab37051cda10aec048cd9cb86c65c68696622bd7e24c12b0c07ebc2e8a0620865fc9a35b2ef34d48c3d8522d57cd672ec287
-
SSDEEP
6144:MMfPp5S6M1Xy0gmfnF8V0dguFJSSvbaU01T/yUhAd5GbdQNJ:Bpg6M1i9mfnFUEgctoLILGbdQf
-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-