Behavioral task
behavioral1
Sample
AccountRipper.exe
Resource
win7-20230220-en
General
-
Target
AccountRipper.exe
-
Size
3.2MB
-
MD5
06cbc080be08dda4bfd5068eeb59c6b0
-
SHA1
1bbda9c31d945429b53dd4784f0bf835e5c551df
-
SHA256
e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
-
SHA512
ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
SSDEEP
49152:6vAt62XlaSFNWPjljiFa2RoUYI0X0+bRSLoGdtTHHB72eh2NT:6vs62XlaSFNWPjljiFXRoUYI0X0T
Malware Config
Extracted
quasar
1.4.1
Proton
212.154.101.132:3000
1b3adac2-334a-4914-b42a-429f32ec011f
-
encryption_key
8738101E98DC472C5F4C9FE5E109DEF1CA883172
-
install_name
Method.exe
-
log_directory
Logs
-
reconnect_delay
2
-
startup_key
Java
-
subdirectory
Proton
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource AccountRipper.exe
Files
-
AccountRipper.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ