General
-
Target
Auzre_Setup.exe
-
Size
6.2MB
-
Sample
240528-dxjc9aea74
-
MD5
50988b63ff85acdb5956b38a05096378
-
SHA1
d9e14e4871218abc7144fb0d7b1a9cafd178d83e
-
SHA256
392525f4166157cec65b28c8fcc84212b17dbd859d50bd4f5f852c9c9c01b4c5
-
SHA512
6dbe20a6fb8ef33fa64b1cc266fd2468ea6f15cfac9e18f677a5a507d213b41c236107117810fcccfd65737ca538f2d1a376bf5e85e5fa9c5365bd322baf773f
-
SSDEEP
98304:URVEtdFBgyMAamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R1BM2h3Bs38:USFyBeN/FJMIDJf0gsAGK4R1u2M38
Malware Config
Targets
-
-
Target
Auzre_Setup.exe
-
Size
6.2MB
-
MD5
50988b63ff85acdb5956b38a05096378
-
SHA1
d9e14e4871218abc7144fb0d7b1a9cafd178d83e
-
SHA256
392525f4166157cec65b28c8fcc84212b17dbd859d50bd4f5f852c9c9c01b4c5
-
SHA512
6dbe20a6fb8ef33fa64b1cc266fd2468ea6f15cfac9e18f677a5a507d213b41c236107117810fcccfd65737ca538f2d1a376bf5e85e5fa9c5365bd322baf773f
-
SSDEEP
98304:URVEtdFBgyMAamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R1BM2h3Bs38:USFyBeN/FJMIDJf0gsAGK4R1u2M38
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-