General
-
Target
cool.exe
-
Size
409KB
-
Sample
240601-x7cs1adc77
-
MD5
8981944139c803c067c3a1fe11dc0d88
-
SHA1
dcc102fba961eaea31a2c218b1f6e4ae2a00c91b
-
SHA256
db5769a8780e6b398f48b33209ba18deb0eefeb0b6df143bb016c1defa718ac5
-
SHA512
668cfa950624ee38e5e0470379b784e14675df4c0f8e75009d28161a88789d3d778a79924d379ab43896d028e94814d582a1c882c5d2918053a320a8e1cc38f5
-
SSDEEP
6144:rMs9p1kREG60ol2tjSujSyfhQkHwKkcY2b+5oydLJF6qty9fHg5a:jpiREGJBtjSujS1k8hoyM/9fHg5a
Behavioral task
behavioral1
Sample
cool.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
cool.exe
Resource
win11-20240508-en
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
adult-mai.gl.at.ply.gg:51745
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
72dhc0vkceueKRBldQr9
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Targets
-
-
Target
cool.exe
-
Size
409KB
-
MD5
8981944139c803c067c3a1fe11dc0d88
-
SHA1
dcc102fba961eaea31a2c218b1f6e4ae2a00c91b
-
SHA256
db5769a8780e6b398f48b33209ba18deb0eefeb0b6df143bb016c1defa718ac5
-
SHA512
668cfa950624ee38e5e0470379b784e14675df4c0f8e75009d28161a88789d3d778a79924d379ab43896d028e94814d582a1c882c5d2918053a320a8e1cc38f5
-
SSDEEP
6144:rMs9p1kREG60ol2tjSujSyfhQkHwKkcY2b+5oydLJF6qty9fHg5a:jpiREGJBtjSujS1k8hoyM/9fHg5a
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-