General
-
Target
2644dec48ca3539cfc4a7b4dba0bd212
-
Size
16KB
-
Sample
240319-ekhrmahf4s
-
MD5
2644dec48ca3539cfc4a7b4dba0bd212
-
SHA1
d5fd9c4b6f865ba7dec0604bdd7b06f0f00023f8
-
SHA256
ea7efe5b685adb6324eea4717d5a9ef0c09c0222acc527d3bff2dc752d0cdcf9
-
SHA512
756a9acf67292a0cc2107188316e0ccf15c3ca8317e65fb5add57a525bb0fece07f5e0d9ef430a54ec21ae6b2a9242f7bd3926b1791dc3e704ae40f10b194ad3
-
SSDEEP
384:l6IyZLpL3LxYLTL62cpOgAM+o/8E9VF0NyA1epRJ:l6rZFz1Yn3cpOgAMxkEnV
Static task
static1
Behavioral task
behavioral1
Sample
2644dec48ca3539cfc4a7b4dba0bd212.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2644dec48ca3539cfc4a7b4dba0bd212.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
quasar
1.4.1
KZ1
77.232.132.25:4999
8892f097-602a-41ca-8df2-0bf3fd113bd2
-
encryption_key
790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB
-
install_name
LestaClient.exe
-
log_directory
LestaLogs
-
reconnect_delay
3000
-
startup_key
Lesta Game Center
-
subdirectory
Lesta
Extracted
asyncrat
0.5.7B
KZ1
77.232.132.25:5001
AsyncMutex_6SI8OJU68
-
delay
3
-
install
false
-
install_file
service.exe
-
install_folder
%AppData%
Targets
-
-
Target
2644dec48ca3539cfc4a7b4dba0bd212
-
Size
16KB
-
MD5
2644dec48ca3539cfc4a7b4dba0bd212
-
SHA1
d5fd9c4b6f865ba7dec0604bdd7b06f0f00023f8
-
SHA256
ea7efe5b685adb6324eea4717d5a9ef0c09c0222acc527d3bff2dc752d0cdcf9
-
SHA512
756a9acf67292a0cc2107188316e0ccf15c3ca8317e65fb5add57a525bb0fece07f5e0d9ef430a54ec21ae6b2a9242f7bd3926b1791dc3e704ae40f10b194ad3
-
SSDEEP
384:l6IyZLpL3LxYLTL62cpOgAM+o/8E9VF0NyA1epRJ:l6rZFz1Yn3cpOgAMxkEnV
-
Quasar payload
-
Async RAT payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-