General
-
Target
1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe
-
Size
916KB
-
Sample
241031-1pw1psslaw
-
MD5
6d48da1b1beffb52e09d892ff7f460c2
-
SHA1
db0c7b45471c64dc695c98a5c61a1d3b0b1c5f41
-
SHA256
cc2cfdb23db8b97c610105eaf704dc18e694b3df11f4a13f7187152955415fdc
-
SHA512
864c83717d0e637dc624fe5b1d30354bb1212226e179eb52143da02b73a664ed805d68600f9370468b93fc1ad4b0c3d1682bdb2ca38d35a47cecd913d34b5228
-
SSDEEP
24576:tmkdueXjq0OQKc2YSEegpQRDLusJLK1lkioLP:IkdueXjq0OQKc2YSEegpshk1lk
Behavioral task
behavioral1
Sample
1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
2.8.0.1
Queda ツ
45.61.174.20:5552
ZltvfUGAo7zsf3naNu
-
encryption_key
EDWqFemxb3ZTD9Ymr9np
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Targets
-
-
Target
1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe
-
Size
916KB
-
MD5
6d48da1b1beffb52e09d892ff7f460c2
-
SHA1
db0c7b45471c64dc695c98a5c61a1d3b0b1c5f41
-
SHA256
cc2cfdb23db8b97c610105eaf704dc18e694b3df11f4a13f7187152955415fdc
-
SHA512
864c83717d0e637dc624fe5b1d30354bb1212226e179eb52143da02b73a664ed805d68600f9370468b93fc1ad4b0c3d1682bdb2ca38d35a47cecd913d34b5228
-
SSDEEP
24576:tmkdueXjq0OQKc2YSEegpQRDLusJLK1lkioLP:IkdueXjq0OQKc2YSEegpshk1lk
-
Quasar family
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-