Extracted

• • Target

    Driver.dll

  • Size

    242KB

  • MD5

    9a41f2a54a2fa0b81b2511e32e914f2c

  • SHA1

    3276c4d7be73019a6a7fe8e218a98228ac930ce4

  • SHA256

    3cc04edaa12d7feed849f1b88e10d49b948b1ef2a62e197ac35d41e5b35dbfcc

  • SHA512

    8fd80dc238b3d8d75797720dc6117ff41b7064804ee243bc3e5d5c847c20856a22b30d9ed579aa1b565fc57c65bd138d913069a26cb71a93b0134b77df36dc27

  • SSDEEP

    3072:2QaHp8CKxa1Kd0B7itS5jWqJgvFmtPb9WxBvk4rFTbRL2LP/jWoF3tK8cDL6v51y:2QFPxm5BetSEqJgtibSs4HvD4YQ

  Score

  1^/10
  behavioral1

• • Target

    SlottedAimV2.exe

  • Size

    7.0MB

  • MD5

    decace854bd66eba96581505cbb1f785

  • SHA1

    dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6

  • SHA256

    ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d

  • SHA512

    e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8

  • SSDEEP

    196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL

  Score

  10^/10

  quasarfortnitespywarestealertrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral2

• • Target

    mciavi32.dll

  • Size

    101KB

  • MD5

    e9944f49dfaa4d580ddfbd676d61d397

  • SHA1

    6f9e0bfec72657355ee400c71668779ee41b5ba6

  • SHA256

    30317e32d7f5e36ad2674353a198f5b2760ff121c40cc0cf11be0cf9729fadb5

  • SHA512

    fd494ad6aa5520e3e115cc5104882aa9922ecb181e61a03969aad73273ffa6cd8c0269994e0eec8676b41d2a7832db722d51b5e0bce9c7a7ed8d11b5330a289b

  • SSDEEP

    1536:4bfvWWJHxioRuscmoKKHeH8vQINmgZUg4nP8lNM3t3qs7SO2xjlyGp8w:4rWmsscmoKgDQInYXt3qsHSJyS8w

  Score

  1^/10
  behavioral3

• • Target

    spwizimg.dll

  • Size

    5.6MB

  • MD5

    6259c2ebf8f1b15c4b075e413bf32598

  • SHA1

    80ef443ed0dc3c93476b7a0edfa0fd76f2baa50a

  • SHA256

    b206630e0c06b9bea1809d80b9f2601ee417857e7c8a22c1854e30c08ea744e1

  • SHA512

    ecab9c71e95dcf2463490f34a2a66f5e9353b4be9af888f30b4e93520b4fa5a6a8fac5e69f84efeb88e195758d951cba8e36c9957eef261f4f9fb063bb04e395

  • SSDEEP

    3072:OtsxIS9L+rz5iG7aB+H+Yge19NT6lBc/0yY+wcE9rCbpxTNX5vNRZWyXzyKblUuB:O6xISpQiG7aBMjNxTNX5vZ

  Score

  1^/10
  behavioral4