Extracted

Extracted

• • Target
    21b45cf293c8b1587d29f4a641b448ff3f817d6c99fa114841858208a0e2ae0a
  • Size 2.0MB
  • SHA256 21b45cf293c8b1587d29f4a641b448ff3f817d6c99fa114841858208a0e2ae0a
  • MD5 c82df801338046f40c951adc0f3a18f1
  • SHA1 c30e8ae474b0a4f8a81fe80a2f1c622dd1935479
  • SHA512 4554c619cfe8eca12cf0d053ad6ac25bda20df3889a073b50f39eac3478df97d11c79ad4efcb29ceadba082f276c41036a59c1bedfae4f9702076da6f08533f4
  • MD5 SHA1 SHA512

  Score

  10^/10

  azorultquasarebayprofilesinfostealerpersistencespywaretrojansuricata

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

    suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2