General
-
Target
JJSPLOIT.V2.exe
-
Size
3.1MB
-
Sample
241224-y2fs5swpcp
-
MD5
d4a776ea55e24d3124a6e0759fb0ac44
-
SHA1
f5932d234baccc992ca910ff12044e8965229852
-
SHA256
7ef4d0236c81894178a6cfc6c27920217bea42a3602ad7a6002834718ba7b93c
-
SHA512
ba9127f7f84e55a37e4eb1dc1a50d10ef044f0b24a23d451187c8d1dedec26d3a37cf78e8763b351ef1e492e26b1ef9b28fc2331591ce1b53c3d76369d100f4b
-
SSDEEP
49152:gvvL82kyaNnwxPlllSWxc9LpQXmrRJ6cbR3LoGdJTHHB72eh2NT:gvD82kyaNnwxPlllSWa9LpQXmrRJ6m
Behavioral task
behavioral1
Sample
JJSPLOIT.V2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JJSPLOIT.V2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
ROBLOX EXECUTOR
192.168.50.1:4782
10.0.0.113:4782
LETSQOOO-62766.portmap.host:62766
89.10.178.51:4782
90faf922-159d-4166-b661-4ba16af8650e
-
encryption_key
FFEE70B90F5EBED6085600C989F1D6D56E2DEC26
-
install_name
windows 3543.exe
-
log_directory
roblox executor
-
reconnect_delay
3000
-
startup_key
windows background updater
-
subdirectory
windows updater
Targets
-
-
Target
JJSPLOIT.V2.exe
-
Size
3.1MB
-
MD5
d4a776ea55e24d3124a6e0759fb0ac44
-
SHA1
f5932d234baccc992ca910ff12044e8965229852
-
SHA256
7ef4d0236c81894178a6cfc6c27920217bea42a3602ad7a6002834718ba7b93c
-
SHA512
ba9127f7f84e55a37e4eb1dc1a50d10ef044f0b24a23d451187c8d1dedec26d3a37cf78e8763b351ef1e492e26b1ef9b28fc2331591ce1b53c3d76369d100f4b
-
SSDEEP
49152:gvvL82kyaNnwxPlllSWxc9LpQXmrRJ6cbR3LoGdJTHHB72eh2NT:gvD82kyaNnwxPlllSWa9LpQXmrRJ6m
Score10/10-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-