hiverat

Sharing

Copy URL

Twitter E-mail

General

Target

d7bda4ea100c3b9b58d9a9095628c064.exe
Size

72KB
Sample

211030-kl1xgsbdfk
MD5

d7bda4ea100c3b9b58d9a9095628c064
SHA1

70cb92dfc7e0dd76d7db1ee2877d87be8be8b638
SHA256

1aec33c9dc704ad71932eee6e128c9eb0908cab49d85f5a0f788484777a68a57
SHA512

56b0b05499881cd07aa9efb640d89b1debe2ac3e5378057b350f91d039056799859b53ad330e83af7f79d223bb234df2e1b32a40b3becc7c295049704606f424

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/612689775702573066/894910938065547284/Cert.reg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/612689775702573066/894910945422368798/hivee.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/612689775702573066/894910956184961054/BITBACKK.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/612689775702573066/897976122757746728/dlscord.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.discordapp.com/attachments/612689775702573066/898608127153410129/PaladinsHackFIX.zip

Extracted

Family

quasar

Version

1.4.0

Botnet

Anubisv2

yoworldservices.space:1338

Mutex

48e1f30b-026f-45d4-b8f7-2bd40381b7db

Attributes

encryption_key
0411D8B9B23547F86733347B0634010F112E158F
install_name
dlscord.exe
log_directory
dlscordLogs
reconnect_delay
3000
startup_key
dlscord
subdirectory
dlscord

Targets

- Target
  
  d7bda4ea100c3b9b58d9a9095628c064.exe
- Size
  
  72KB
- MD5
  
  d7bda4ea100c3b9b58d9a9095628c064
- SHA1
  
  70cb92dfc7e0dd76d7db1ee2877d87be8be8b638
- SHA256
  
  1aec33c9dc704ad71932eee6e128c9eb0908cab49d85f5a0f788484777a68a57
- SHA512
  
  56b0b05499881cd07aa9efb640d89b1debe2ac3e5378057b350f91d039056799859b53ad330e83af7f79d223bb234df2e1b32a40b3becc7c295049704606f424
Score

10^/10

hiverat quasar anubisv2 aspackv2 persistence rat spyware stealer trojan upx
- HiveRAT
  HiveRAT is an improved version of FirebirdRAT with various capabilities.
  rat stealer hiverat
- Quasar Payload
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- HiveRAT Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Quasar Payload

Quasar RAT

HiveRAT Payload

ASPack v2.12-2.42

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2