General
-
Target
srxchost.exe
-
Size
409KB
-
Sample
240606-n5ncaadg9t
-
MD5
3646d83b4b68c7a7de0c4cb99c6550c9
-
SHA1
1f84405a3a18a24d58eb62a13dd1cfe5c4b6d3d1
-
SHA256
12dc2f09f5cb5160771e12b5128de26fde6bab70cee6d063859eea955df1216c
-
SHA512
707b7b35f9504fa4b18ca1175e010771e67c3096b2d7552dc03c0bfb1bb377bfe360e2b49ce3ebc1408b6fac9838e5b8af26721650e8b5823969a12501fb0107
-
SSDEEP
12288:9piREGJiVp4B6eODSwejGz1VIudSJRZfwmJweOJsn:TwpJj8Nd+RZImJf
Behavioral task
behavioral1
Sample
srxchost.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
srxchost.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
srxchost.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
srxchost.exe
Resource
win11-20240508-en
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
dating-mpegs.gl.at.ply.gg:6566
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
RtxBjTfEK9dH2O6DfNVH
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Targets
-
-
Target
srxchost.exe
-
Size
409KB
-
MD5
3646d83b4b68c7a7de0c4cb99c6550c9
-
SHA1
1f84405a3a18a24d58eb62a13dd1cfe5c4b6d3d1
-
SHA256
12dc2f09f5cb5160771e12b5128de26fde6bab70cee6d063859eea955df1216c
-
SHA512
707b7b35f9504fa4b18ca1175e010771e67c3096b2d7552dc03c0bfb1bb377bfe360e2b49ce3ebc1408b6fac9838e5b8af26721650e8b5823969a12501fb0107
-
SSDEEP
12288:9piREGJiVp4B6eODSwejGz1VIudSJRZfwmJweOJsn:TwpJj8Nd+RZImJf
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-