General
-
Target
4Malware.zip
-
Size
6.1MB
-
Sample
231209-bmx3jsdhcj
-
MD5
bea2ac31ab219cbbc749b0aeeff7e872
-
SHA1
2edc2a00dde9c973fce77348e07310558855dabf
-
SHA256
2cd40802f898dd95f0756aa6c44263c38131379d0db2da72f37bfa8f53668412
-
SHA512
e0f67143df31d2701e3ec21d3eaf6d74725de1559963c2713c4e0f48264cdab544536e08278d86ec3c0b2f7494c06a5ebe8a24d19842cfcde0f8157e729c889f
-
SSDEEP
196608:zjgzmPgjU3TJJ5/BAyG8jCz/atKPHGnYb:vbEUDvnGLjatKfGYb
Behavioral task
behavioral1
Sample
4Malware.zip
Resource
win10v2004-20231127-en
Behavioral task
behavioral2
Sample
Adobe-GenP-3.0.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
Qblqxvgkmiptnw.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral4
Sample
Set-up.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
winnnn.exe
Resource
win10v2004-20231127-en
Malware Config
Extracted
quasar
1.4.1
Windows Update
141.98.112.144:4782
192.168.1.1:4782
43e4244e-f515-4759-a0f9-81d1dfceed2f
-
encryption_key
535B385BFDC78C4C5A8DEE5D1390F4841681628D
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Extracted
formbook
4.1
kmge
jia0752d.com
cq0jt.sbs
whimsicalweddingrentals.com
meetsex-here.life
hhe-crv220.com
bedbillionaire.com
soycmo.com
mrawkward.xyz
11ramshornroad.com
motoyonaturals.com
thischicloves.com
gacorbet.pro
ihsanid.com
pancaketurner.com
santanarstore.com
cr3dtv.com
negotools.com
landfillequip.com
sejasuapropriachefe.com
diamant-verkopen.store
builtonmybrother.art
teoti.beauty
kickssoccercamp.com
chickfrau.com
compare-energy.com
icvp5o.xyz
susan-writes.com
dropletcoin.com
sivertool.com
sup-25987659.com
weedz-seeds.today
agritamaperkasaindonesia.com
safwankhalil.com
jm2s8a3mz.com
wfjwjm.com
be-heatpumps.life
hcwoodpanel.com
n5l780.com
mandalah.art
szexvideokingyen.sbs
justinroemmick.com
thecoolkidsdontfitin.com
gsolartech.com
swisswearables.com
chicagocarpetcleaneril.com
terrazahills-cbre.com
santatainha.com
sacksmantenimiento.store
wzhem.rest
shearwaterpembrokeshire.com
baansantiburi.com
mid-size-suv-87652.com
solunchina.com
nandos.moe
blucretebistro.com
identificatiekvk.digital
8772876.com
longfangyun.com
litblacklit.com
mobilferrari.com
zeeedajewelermusic.com
allenbach.swiss
industrialrevolution.ink
cmgamingtrack.com
a2zglobalimports.com
Targets
-
-
Target
4Malware.zip
-
Size
6.1MB
-
MD5
bea2ac31ab219cbbc749b0aeeff7e872
-
SHA1
2edc2a00dde9c973fce77348e07310558855dabf
-
SHA256
2cd40802f898dd95f0756aa6c44263c38131379d0db2da72f37bfa8f53668412
-
SHA512
e0f67143df31d2701e3ec21d3eaf6d74725de1559963c2713c4e0f48264cdab544536e08278d86ec3c0b2f7494c06a5ebe8a24d19842cfcde0f8157e729c889f
-
SSDEEP
196608:zjgzmPgjU3TJJ5/BAyG8jCz/atKPHGnYb:vbEUDvnGLjatKfGYb
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Quasar payload
-
Formbook payload
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
-
-
Target
Adobe-GenP-3.0.exe
-
Size
1.5MB
-
MD5
ed76bdafd8d0aeb9429dd3b09d506c1a
-
SHA1
7a2ffe3a4ff3c0b73eb0205b98cca46fe2cfc1a5
-
SHA256
dd0927db589aa8ebd7b81988de635cecfc55da14821f2a3284af2809c16169be
-
SHA512
34cfc2d036c695a8a09992759a777338111392016675484ae4a80490c12ee86ffc1c1a7f178c95aac8d61bd98c0d4b2e35437c11c369c7b7bdedea94ede3c29b
-
SSDEEP
24576:TrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvajHeqtGHhqGx/7m4gDXww7V:T2EYTb8atv1orq+pEiSDTj1VyvBajHej
Score1/10 -
-
-
Target
Qblqxvgkmiptnw.exe
-
Size
1.8MB
-
MD5
5367274c27e38bafd0a7802ff489e020
-
SHA1
10369f258a0e27088d74713c71030de2d2a97854
-
SHA256
6d2fc83551518ed142a7b984c38f47b34fe1a2399914b323fa7ad23158a2e0a3
-
SHA512
bb56b44babf6fbdba52565d8d721a83f105918bd3db1364df9f1b786b8a1daef3a6c412d9b15a388d890b8342d0ecb0fd0548768bf3d9b87662af50a57352744
-
SSDEEP
24576:nxCxAUDAImqXeE8oqGQCbPEzbjvy27w6tmQ4Xl+gWeq9X9VxHfg8IitnJ0MNd:nx6VDNXr1+vzw6tmQA+qq/H48htnOM/
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
-
-
Target
Set-up.exe
-
Size
7.3MB
-
MD5
03663c723e15534e29f315af658c9d4a
-
SHA1
615952faf3d9153ff8eb356780867f22bd638835
-
SHA256
df028bfa49f56f10268fdebb92786896303ea7a4b885bc93d982beb43375e469
-
SHA512
fb497968b1ad152e63adf5ea43b57b1b6ddf9c453597cbd54c5994edd4b7f17d54bb51f9b653578b3995e5b128455b5be048d1528e19d6be3fffd966d93ff13f
-
SSDEEP
98304:8z16s9EwkidrwQwPdz9u/ZZmDZJErFXQbZT7wIX0o5:8z16gBrd3gu/XmDZiF0tr
Score1/10 -
-
-
Target
winnnn.exe
-
Size
3.1MB
-
MD5
94b66c3142933d8414614b25129de4f6
-
SHA1
77f04ff0308d49aadd34c5082b691118b26fe949
-
SHA256
8b757b585ccc9a12ad57fe10fa901d3ab17ee33b7475978c891cae4f1fb00a84
-
SHA512
afdaab59cddc58d560f81dc959278984b2352a91cb5132d577f7e0d562456162807178fb7dab47578511ab5a2f1630d2f65fcdad84d167ccb862587d3845727d
-
SSDEEP
49152:DvrI22SsaNYfdPBldt698dBcjH4hRJ6abR3LoGdh0THHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjH4hRJ60
Score10/10-
Quasar payload
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
2Defense Evasion
Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1