Release (1).rar
- SHA256 8904d96a473dd52cd5255e046d47148eb27cc778395fff4f220bbb9509f643d8
Overview
overview
10Static
static
10Release (1).rar
windows7-x64
3Release (1).rar
windows10-2004-x64
3Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IDTOIPBYR_0.deps.json
windows7-x64
3IDTOIPBYR_0.deps.json
windows10-2004-x64
3IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.pdb
windows7-x64
3IDTOIPBYR_0.pdb
windows10-2004-x64
3IDTOIPBYR_...g.json
windows7-x64
3IDTOIPBYR_...g.json
windows10-2004-x64
3System.Management.dll
windows7-x64
1System.Management.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win7-20240221-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
IDTOIPBYR_0.deps.json
Resource
win7-20240220-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral6
Sample
IDTOIPBYR_0.deps.json
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
IDTOIPBYR_0.exe
Resource
win7-20240419-en
windows7-x64
13 signatures
600 seconds
Behavioral task
behavioral8
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
600 seconds
Behavioral task
behavioral9
Sample
IDTOIPBYR_0.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
600 seconds
Behavioral task
behavioral10
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
600 seconds
Behavioral task
behavioral11
Sample
IDTOIPBYR_0.pdb
Resource
win7-20240220-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral12
Sample
IDTOIPBYR_0.pdb
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral13
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win7-20240221-en
windows7-x64
5 signatures
600 seconds
Behavioral task
behavioral14
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral15
Sample
System.Management.dll
Resource
win7-20231129-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
System.Management.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
600 seconds
General
- Target Release (1).rar
- Size 2.1MB
- Sample240428-ac5tzabe55
- SHA256 8904d96a473dd52cd5255e046d47148eb27cc778395fff4f220bbb9509f643d8
- MD5 d3efe853d6c513b2d6902725046b6ca5
- SHA1 c35339b4153832e66876908933636e129f7a1a2c
- SHA512 b737ca1a9a89141bfec0c78384b794abc04b141ee5c67425a0f96b2bf44dcd20b40cd8193bc05b83d80f542e1aca99df82e1be5bf0c2c9f8f8f7a83326d537ec
- SSDEEP 49152:LcfFNSDhMpeKfGO4xsJsDv+IVFH0xCf33auJ06cwPh2:WnoMrfGOpJsDv+UFHr/5S
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
3.1.5
Botnet
-
Office04
C2
-
147.185.221.19:33587
Mutex
-
$Sxr-lG7PreqFKmNhJc0CKS
Attributes
-
encryption_key
11fnZjAdVB1EIQVhl7wn
-
install_name
DLLrunhost.exe
-
log_directory
UpdLogs
-
reconnect_delay
3000
-
startup_key
WindowsAudioHelper
-
subdirectory
Windows
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/Guna.UI2.dll family_agenttesla - Agenttesla family
- Quasar family
- Quasar payload 1 IoCs
resource yara_rule static1/unpack001/IDTOIPBYR_0.exe family_quasar - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/IDTOIPBYR_0.dll unpack001/IDTOIPBYR_0.exe
File Explorer
-
Release (1).rar.rar 2.1MB
-
Guna.UI2.dll.dll 2.1MB
-
IDTOIPBYR_0.deps.json2KB
-
IDTOIPBYR_0.dll.exe 38KB
-
IDTOIPBYR_0.exe.exe 413KB
-
IDTOIPBYR_0.pdb17KB
-
IDTOIPBYR_0.runtimeconfig.json458B
-
System.Management.dll.dll 72KB
Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
- MD5 b429ae86c5be521bc8ca3b164cec3acb
- SHA1 387560073ff5a1f2191abc6f75fc34532bbb6dd2
- SHA512 eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1
- SSDEEP 24576:DgWuftU4WrNOA6sM6kXxMfNmnjk/c5NrH0UUoo2QkJXVSItH5ppoO0KzJ6nFwHQL:DA+NOpXm1mnj0cP+DkhMAiawnFV
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
5e:00:a7:1b:7e:46:57:12:de:98:da:e3:8d:91:ea:26:6d:ef:71:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2226574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IDTOIPBYR_0.deps.json
- SHA256 56ab1b179ec0bafceca428c50b5a887c0708914e68c2c1e8c120811215890724
- MD5 a894cb3d393263325741b472605a088e
- SHA1 41b9c4ff3c761bb362457cb5225f136ca8a93beb
- SHA512 c4169a125a0b3add6cbbce853229bfdad1cbc7fc2fd9580ec9851e42d91d12d8a729045623f934f19bcdf21ae23328d8516f1abfc29fc7530157712df6e2cbf6
- MD5 SHA1 SHA512
IDTOIPBYR_0.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c924d7502dcf3af74739270218066f0431678e122fa35aefefdacc1edd2b1b0c
- MD5 b653b660e1aca5529c24b1ee268b2829
- SHA1 a05cbb401ab1648e1078f1a27286c5f7155d357f
- SHA512 9cee437b7524deabc31d9a219e77ef72cbc342563e6c34a0f2aa568b8b35a91cfe81c91fcd6ba085238664f374d200d6017e3e6fd8c5e0d0f751b802fc043e2f
- SSDEEP 384:nLRF4OFc5Kjagmz2OpZkWX+lnjofGZTW65TRE0iA97aa9yN+JWhDCEjUoe0BFqCd:nLRFDTXOGZv5O0iW2awrUoDBFq3D0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44138
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\miles\source\repos\IDTOIPBYR_0\IDTOIPBYR_0\obj\Release\net8.0-windows\IDTOIPBYR_0.pdb
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IDTOIPBYR_0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4466cd4392c0fa3c49979664630db1b607e129c858fd44507cf5fc6b5b9dd3ba
- MD5 aabcedbac7ad8b10993f6de878be1ba4
- SHA1 be8ea58edc1e83ebf33fe0e87a29916e9c554426
- SHA512 5a2bb094997699335a149ca353dc5e98e66482aa9dadc52502068337760bbd65bd648b3935777f4424e9811705657bcd2eb38254d731d892256d578c1f1eaf66
- SSDEEP 6144:2gmEjkzQT1TVNSeE7E11zVeusnib8YoVHR8z0n7kgpMRqZGe:T1TVVXEo13eusHnVH9pMRWGe
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
427294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
409KB
Virtual Size
409KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
IDTOIPBYR_0.pdb
- SHA256 664257f7eaea44c12ce83162d278a046cbdc743c21d68ceddb551f7ff7fa030f
- MD5 eaade6e9725fad7772315e2b9d1e82aa
- SHA1 bd643be28415cbfda78d9e9dc685cee28cbf3651
- SHA512 39fbdbb7e34a342695769816f3437eed4fe4d677322a878c561d159bf43f8fb6ed9e1625ccd2405c2e5d2a9234b9e3e3ed38fdeebd6f170543e538d2704d508c
- SSDEEP 384:Df8jdHvTyslX+A60a09v2osS0HZtOGjBO7QUMbpBkPMg/cpX4rfH8f6Awb3LjBAv:SH7yTTOUeGbpBk0gEUBAv
- MD5 SHA1 SHA512 SSDEEP
IDTOIPBYR_0.runtimeconfig.json
- SHA256 c71152bf25e40d647b2440c5b39be157a3d356106be9d5b678ab97bb87b4e782
- MD5 07b9a30265ca4e69c7016a1b6e3ffc27
- SHA1 3a4af82a2695b1423aedd8b60a5c86793c011b02
- SHA512 efd582f8edcdba5ef48d02eee5f73d83ff35071af99b49e08e0213928568d728d0856e3b903bfcccb9237f786846cf94da83139f99e9bee86287aff2071c3f1c
- MD5 SHA1 SHA512
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f515ca5c944c332ab706ff0a7c2e53e66d0d9d8a663e9b2691b35129ee22559b
- MD5 1c71e5310151ce1e9a3a92797776bdad
- SHA1 fd452b874fec4a9dae61a3710fb32749dc7d701e
- SHA512 2a4f18c77449c2d06a3ab6807338f73b03b1faa332e78319829ba3a2b6fd98bb9a83c5e29b47d55e4ce7f0dfdcd8524fa592a0f3ca8ee09daae2894b681265a8
- SSDEEP 768:BrEP45HksbMU3se5c/0b/9nLZV1BCUkVoV0lP7H0CkkiSLJKdbY8Mtuo0eDQP9zu:bbz5wulNV1zkSQzHxkxS9yc8no0nzu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:dd:70:75:07:79:76:e9:4c:2e:f9:e2:e8:a9:c9:0c:99:41:ca:c8:0f:9f:d0:4f:af:43:ef:2a:ed:0a:ac:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 26, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2022 - Aug 3, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
68690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net7.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ