General
-
Target
05d8a8bf79967e16aa9cf2901d0b51727c5f85414d94e9a1285145abf3398982.zip
-
Size
3.0MB
-
Sample
211024-gknnzsdcc7
-
MD5
30a5a274a04a0afa4b1fcd9cee3e8007
-
SHA1
549cef6061e4c250fa7862ee94d8fd503d5073ff
-
SHA256
404bd9129e5278d4b52da95e23861e32883f8c31daefc7a8ca7dbff279b84111
-
SHA512
ea0f711e0070f433a7024f919b325cd0679b81d0b8c6a3f5e8cf9bf30b751614609ba469e76c2ebc75f902e56f3a33b612d33f02f91388c7f24d412ee60e14be
Static task
static1
Behavioral task
behavioral1
Sample
05D8A8BF79967E16AA9CF2901D0B51727C5F85414D94E9A1285145ABF3398982.exe
Resource
win7-en-20210920
Malware Config
Extracted
asyncrat
0.5.7B
Default
pettbull.ddns.net:6606
pettbull.ddns.net:7707
pettbull.ddns.net:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Extracted
quasar
1.4.0
PRO21
pettbull.ddns.net:4782
23e7ca58-8298-4c9f-b276-3466dcf2cfc0
-
encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
-
install_name
Windows Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Windows
-
subdirectory
System32
Targets
-
-
Target
05D8A8BF79967E16AA9CF2901D0B51727C5F85414D94E9A1285145ABF3398982
-
Size
3.1MB
-
MD5
9aad21656226a1e5faecd8845f6bf5f6
-
SHA1
c842abda589d1a9e70b4201e92b84294e396604f
-
SHA256
05d8a8bf79967e16aa9cf2901d0b51727c5f85414d94e9a1285145abf3398982
-
SHA512
0f3443509607616649d6d804d17b53a8b7b05c82835958d9237660aa86881e28e43386d984b42776f53601f47dc639af0f15c3af47d0a7e47921ffbfa551605d
-
Quasar Payload
-
Async RAT payload
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-