General
-
Target
FlashingSoftwarePRO.exe
-
Size
3.1MB
-
Sample
241216-xeyvrsykhq
-
MD5
cee9f55f2ed2ad11bf3acb650277237a
-
SHA1
3515900f7d4ba68720cb506200f2dcff401a9a6e
-
SHA256
527ebcd94bab6471192fa739e3ee318a7781c79c5a266b0795214bce0398ed35
-
SHA512
da46b87edbf315b88f069d2670c440fb9ea76a1bde9742855fcf80c7bbad5ea4d895c90d97d62a57782cd2572f3db7c90667aabe34e37c6bf543da6ea323d906
-
SSDEEP
49152:/vJuf2NUaNmwzPWlvdaKM7ZxTwqky3EfsKk/WPIoGd0THHB72eh2NT:/vkf2NUaNmwzPWlvdaB7ZxTwqkyAw
Behavioral task
behavioral1
Sample
FlashingSoftwarePRO.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
svchost
quasqy10-51732.portmap.host:4782
193.161.193.99:4782
7d600197-9219-48e3-b7cb-1cd264aa77fa
-
encryption_key
BDB44181C868606DFCA1741A69056AAA62DADEFC
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
System32
Targets
-
-
Target
FlashingSoftwarePRO.exe
-
Size
3.1MB
-
MD5
cee9f55f2ed2ad11bf3acb650277237a
-
SHA1
3515900f7d4ba68720cb506200f2dcff401a9a6e
-
SHA256
527ebcd94bab6471192fa739e3ee318a7781c79c5a266b0795214bce0398ed35
-
SHA512
da46b87edbf315b88f069d2670c440fb9ea76a1bde9742855fcf80c7bbad5ea4d895c90d97d62a57782cd2572f3db7c90667aabe34e37c6bf543da6ea323d906
-
SSDEEP
49152:/vJuf2NUaNmwzPWlvdaKM7ZxTwqky3EfsKk/WPIoGd0THHB72eh2NT:/vkf2NUaNmwzPWlvdaB7ZxTwqkyAw
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-