General
-
Target
robloxtockenstealer.exe
-
Size
3.2MB
-
Sample
241116-x77cls1pcy
-
MD5
e7c12a69820f13031fbc2a3bfe6cff2b
-
SHA1
8959411ec12367b73ceb4971eb0bed6bf8773a35
-
SHA256
e37f5e8a493f127516a17a57e47bb891d665f8a0aed15871c8551c94b38398e4
-
SHA512
25a4a9124d386ece9a3c044d7bc0d03281b901ec8d6f96b840d51f7ec0702da9bf16f07fdda98b0a15409ca604629b3220cbcdc9cff24629eeeb38462282ecde
-
SSDEEP
98304:DFqg2FttFGwikj7yVEErTRHX0tsEwwjBWOWeYMWmWjn2:DFqgibV7yVDrFHEtsEwwIFM3
Static task
static1
Behavioral task
behavioral1
Sample
robloxtockenstealer.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.56.1:4782
47f0198a-a3d8-4194-852e-7997def309cf
-
encryption_key
C420C6BA5A73AFC71829A3D6D18F010F1FDAE794
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
robloxtockenstealer.exe
-
Size
3.2MB
-
MD5
e7c12a69820f13031fbc2a3bfe6cff2b
-
SHA1
8959411ec12367b73ceb4971eb0bed6bf8773a35
-
SHA256
e37f5e8a493f127516a17a57e47bb891d665f8a0aed15871c8551c94b38398e4
-
SHA512
25a4a9124d386ece9a3c044d7bc0d03281b901ec8d6f96b840d51f7ec0702da9bf16f07fdda98b0a15409ca604629b3220cbcdc9cff24629eeeb38462282ecde
-
SSDEEP
98304:DFqg2FttFGwikj7yVEErTRHX0tsEwwjBWOWeYMWmWjn2:DFqgibV7yVDrFHEtsEwwIFM3
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-