General
-
Target
AccountRipper.exe
-
Size
3.2MB
-
Sample
230610-qsxrasfa73
-
MD5
06cbc080be08dda4bfd5068eeb59c6b0
-
SHA1
1bbda9c31d945429b53dd4784f0bf835e5c551df
-
SHA256
e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
-
SHA512
ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
SSDEEP
49152:6vAt62XlaSFNWPjljiFa2RoUYI0X0+bRSLoGdtTHHB72eh2NT:6vs62XlaSFNWPjljiFXRoUYI0X0T
Behavioral task
behavioral1
Sample
AccountRipper.exe
Resource
win7-20230220-en
Malware Config
Extracted
quasar
1.4.1
Proton
212.154.101.132:3000
1b3adac2-334a-4914-b42a-429f32ec011f
-
encryption_key
8738101E98DC472C5F4C9FE5E109DEF1CA883172
-
install_name
Method.exe
-
log_directory
Logs
-
reconnect_delay
2
-
startup_key
Java
-
subdirectory
Proton
Targets
-
-
Target
AccountRipper.exe
-
Size
3.2MB
-
MD5
06cbc080be08dda4bfd5068eeb59c6b0
-
SHA1
1bbda9c31d945429b53dd4784f0bf835e5c551df
-
SHA256
e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
-
SHA512
ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
SSDEEP
49152:6vAt62XlaSFNWPjljiFa2RoUYI0X0+bRSLoGdtTHHB72eh2NT:6vs62XlaSFNWPjljiFXRoUYI0X0T
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-