General
-
Target
svchost.exe
-
Size
409KB
-
Sample
240821-tvw5bssbrq
-
MD5
6208705452298d423e61f3ed8daa0e8d
-
SHA1
3d10b4034a3bc8331cd08e7cbffdc2a15e75c022
-
SHA256
27f7cd11912de002c5def057380f2676dc58a7476780e7ee8576fce5f4d16c4a
-
SHA512
b5450f02d2f245ec05febaec126b14ad0c880cda52aa4bbde57fbfc599b51b32a4e04f358c6b2878a6546b34ca6dcd9eb651f657acf5392a59e950efe55f4e54
-
SSDEEP
12288:6psD64e1MN61MQeBw+JFB/BzDEQBndZKC:esG4kM+eBnPBHEsZb
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
svchost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
svchost.exe
Resource
win11-20240802-en
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
topics-findlaw.gl.at.ply.gg:14588
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
90pjC3Fx1UViGcZXRXG9
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Targets
-
-
Target
svchost.exe
-
Size
409KB
-
MD5
6208705452298d423e61f3ed8daa0e8d
-
SHA1
3d10b4034a3bc8331cd08e7cbffdc2a15e75c022
-
SHA256
27f7cd11912de002c5def057380f2676dc58a7476780e7ee8576fce5f4d16c4a
-
SHA512
b5450f02d2f245ec05febaec126b14ad0c880cda52aa4bbde57fbfc599b51b32a4e04f358c6b2878a6546b34ca6dcd9eb651f657acf5392a59e950efe55f4e54
-
SSDEEP
12288:6psD64e1MN61MQeBw+JFB/BzDEQBndZKC:esG4kM+eBnPBHEsZb
Score10/10-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-