General

  • Target

    132db3681039b4b19acf98c8fd836f40_NeikiAnalytics

  • Size

    2.0MB

  • Sample

    240509-2kb1eadh45

  • MD5

    132db3681039b4b19acf98c8fd836f40

  • SHA1

    af71fafbca4194d15574aa5bcfeeaf2d69d0b126

  • SHA256

    48789ee6ad02c43062dea96c6b5bb69ce7aeb94bb9748fc80ba4a42d3c0b7b72

  • SHA512

    ee29c3add7572441de2b2a12916dcf24caff4779f01171f077f2b7817cb9c930754b2d59f3e0dd67af85117e1f86a61feed2e7f00a29df20578bc7984442ec4d

  • SSDEEP

    24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYp:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yj

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Targets

    • Target

      132db3681039b4b19acf98c8fd836f40_NeikiAnalytics

    • Size

      2.0MB

    • MD5

      132db3681039b4b19acf98c8fd836f40

    • SHA1

      af71fafbca4194d15574aa5bcfeeaf2d69d0b126

    • SHA256

      48789ee6ad02c43062dea96c6b5bb69ce7aeb94bb9748fc80ba4a42d3c0b7b72

    • SHA512

      ee29c3add7572441de2b2a12916dcf24caff4779f01171f077f2b7817cb9c930754b2d59f3e0dd67af85117e1f86a61feed2e7f00a29df20578bc7984442ec4d

    • SSDEEP

      24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYp:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yj

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.