agenttesla | 0ab74ff99068e4cdaf14dc3770619637a92381be06682ff77578050b4ab4265e

General

Target
obvious rat niggaa.zip
Size 1.6MB
Sample240503-w16basfh82
SHA256 0ab74ff99068e4cdaf14dc3770619637a92381be06682ff77578050b4ab4265e
MD5 9a9593e8311a5aae9a66bde1b7a5ab15
SHA1 27c32d63d96ef2c6d99896e649107c3c3254b365
SHA512 25be1387eec11fd07dfef9d74744d6bea38e3c3550c5a9dd7dab172e072cda6d9c315d2504ad046d9de81fb3b587fe06a445c640293b2f140b1ab8d7f6b03809
SSDEEP 49152:Cl4xHkTvSCQtNJ08bh4CLECHkCCHUXU71YK+:C+7NJXbaCQCBC0X03+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

$77 Flusher

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-3vDee7FzoJnhqjuE3n

Attributes

encryption_key
GX9vycIPcQc04h4dOPgm
install_name
$77Remover.exe
log_directory
Logs
reconnect_delay
1000
startup_key
$77 Rootkit Remover
subdirectory
$77 Removal Tool

Targets

- Target
  $77 Detection.dll
- Size 1.3MB
- SHA256 41508af363730c9df614bfe3e498cf5dc4565ec54907f7fb26bd86194e5ff3de
- MD5 80feaeb7b8c493df5534c2b5c2c43bae
- SHA1 c73542b0a4247442c2aa979b7d4e7210ed87e03a
- SHA512 7e627e64e2273d6f0c054decd3e9cd6845d191f56e1ce29591a011e59b815805a26eba36c7746893567058fe21bde887a37c1aa89bcbae749ff00eec66d6a69b
- SSDEEP 24576:7PhshAfmAoEpwQQWhZ62KLp+CkAdjG3sMs2Cd5o775AxUzNZsPbKAayFHV+Sg:NrHCkAdjG3sMs2Cd5o775AxUzN8JayFr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  $77 Removal Tool.exe
- Size 409KB
- SHA256 ad4f988a89e1ca7d8db44144b8b344a74f10b1a7e3643ad32782c9c24a3bfcb9
- MD5 07f4778c3708c0c130dbb45cf1633dbd
- SHA1 5188ff38d1b3d9fb1cb60b3820861f518700422f
- SHA512 87fe4e61e0903b7d3b8ba27e939bd51b822753b3bd94bcee3bc6f6f0f8973ce74ba9d3238cd2124265f8d7748fd8960ecc45e77326a90ac69158b9f774556036
- SSDEEP 6144:LMx9p1kREG60ol3dhNNV+2qgP9nTgMSghCb58ABnB6E9CJmAorfrzlC:mpiREGJ6hNNV3qm9njGnBd95HrfrJC
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar $77 flusher persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral2
- Target
  Guna.UI2.dll
- Size 1.9MB
- SHA256 836e1cc306eab0817a10c613a9c99d4dcbd604624b8b90f551d410dc164eef82
- MD5 83e9df5d534f50280251d662861bf476
- SHA1 d2ecd37e462b3c6fa763341a12f9de74326cb646
- SHA512 af38cfbd5fb866662afa4548011ba2d262cd70ff145fe4118db3322a9ea243bd9d8dc9cdfc62a246df014949a94d159bcd47a8f8f04010b93c963511a7e6a72a
- SSDEEP 24576:+5lxrKZ9DHFoXP/Jt/A1IKKPZANZuwgHQ/jz41RMIK24:Av/CIRqwRMIK24
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  Mono.Cecil.dll
- Size 277KB
- SHA256 3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e
- MD5 8df4d6b5dc1629fcefcdc20210a88eac
- SHA1 16c661757ad90eb84228aa3487db11a2eac6fe64
- SHA512 874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174
- SSDEEP 6144:iYOMWAEq+PAEwGQ9Xivs0s4EtS1Fv8jnLKdFvkPo2:AG+PpjQSHv8jA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  Mono.Nat.dll
- Size 40KB
- SHA256 b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
- MD5 bf929442b12d4b5f9906b29834bf7db1
- SHA1 810a2b3c8e548d1df931538bc304cc1405f7a32b
- SHA512 9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
- SSDEEP 768:yoVesKx0V2LpibQJxoKUDHj560aSX3zlJAO:lVespQibC+H56k3fF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  netstandard.dll
- Size 88KB
- SHA256 6ae62e082dc494a2433984177f60ca4db5fae69b1f360a8b33754172b310b8c5
- MD5 c61967ebe7f07f6a5a1b3f91842bbc3c
- SHA1 c2db6e7376977c5c7f17d816406ca70f95d8e1ef
- SHA512 5e63289f67a2b5d436d192a6354444327c4939e854cdae82614950885265fcc76739219138f22c55171362b735169ed77e0699958b4960a909f6ec919ce3aa49
- SSDEEP 1536:zsYKt7WAMU9UYk5f4bJUHGPdghpuSX5qUE7cLh9z+:3K4AMaUYm4bJUiIBh1+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6