General
-
Target
70d30b23348309c31e6428730d77012f_JaffaCakes118
-
Size
349KB
-
Sample
240525-es3rrsec53
-
MD5
70d30b23348309c31e6428730d77012f
-
SHA1
2d3e3669099989d1bcbbf59170eaf0e66d82aef7
-
SHA256
5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5
-
SHA512
9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1
-
SSDEEP
6144:yKMJx4pweP7kJS3i37EOv2l3e6NfAwfBMyb0ezPcLf/9t:yKoS8wOvEe6lzfBEmQ9t
Behavioral task
behavioral1
Sample
70d30b23348309c31e6428730d77012f_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
quasar
1.3.0.0
rat2020
rat25565.ddns.net:25565
QSR_MUTEX_N4xtXyWxcnI1berfYb
-
encryption_key
OtebFaj10j3Qk2642HWk
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
EpicGames Client
-
subdirectory
SubDir
Targets
-
-
Target
70d30b23348309c31e6428730d77012f_JaffaCakes118
-
Size
349KB
-
MD5
70d30b23348309c31e6428730d77012f
-
SHA1
2d3e3669099989d1bcbbf59170eaf0e66d82aef7
-
SHA256
5304204c73f6a5ff58c1a9e784139111a477b274b29f93666ba9e0d5fd4f36f5
-
SHA512
9cff8845e74094fa2daf19666b6817de04d9b96ae85b5a35f2313a4cc520b87f7fb30d88801d3a740877a89a46de4542ad124779148b5ef6ba9917a261effaa1
-
SSDEEP
6144:yKMJx4pweP7kJS3i37EOv2l3e6NfAwfBMyb0ezPcLf/9t:yKoS8wOvEe6lzfBEmQ9t
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-