General
-
Target
59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4
-
Size
348KB
-
Sample
241204-2a8lmatrgs
-
MD5
e3227ee81215e58ad2b59b277ffb79f4
-
SHA1
cfc16846c11f280d907f151a3745827313e92fbf
-
SHA256
59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4
-
SHA512
b146155add08215e7376fe8ea2e8d8080467326de410eeee8feddcd27b5b821143d23f84d87d52f0c2e3601f9519ccd589e00249c008671f6572c348d09e248f
-
SSDEEP
6144:Aw6bPXhLApfpZUAlrmOW5bkjz3jnRBPtcW:xmhAp0Al8WjnRBP2W
Behavioral task
behavioral1
Sample
59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.3.0.0
Office04
myhost88.ddns.net:4782
QSR_MUTEX_gBbXbVHlujwl4SvP3X
-
encryption_key
7Bgb3YgUbXKS2un5vbeM
-
install_name
ms configs.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ms configs
-
subdirectory
SubDir
Targets
-
-
Target
59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4
-
Size
348KB
-
MD5
e3227ee81215e58ad2b59b277ffb79f4
-
SHA1
cfc16846c11f280d907f151a3745827313e92fbf
-
SHA256
59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4
-
SHA512
b146155add08215e7376fe8ea2e8d8080467326de410eeee8feddcd27b5b821143d23f84d87d52f0c2e3601f9519ccd589e00249c008671f6572c348d09e248f
-
SSDEEP
6144:Aw6bPXhLApfpZUAlrmOW5bkjz3jnRBPtcW:xmhAp0Al8WjnRBP2W
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-