General
-
Target
Loader.exe
-
Size
409KB
-
Sample
240627-1rybjswajp
-
MD5
808d880b4fc7f865fb607337690b5575
-
SHA1
7782ec3da7a6f8ed196d4431c59d50690580ac39
-
SHA256
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962
-
SHA512
7a7ee833835d9469a1a5b48a5cbf9c902f362d82ad37b2ba99944e692b4322c140d770dc7be30f8ace7b84d6508e4d2e5f2007294ca3c07094bbfca8120ec6a8
-
SSDEEP
12288:KpsD64e1Muxkk3abqow6dL+32oJN/nSjCt1hw:OsG4kMUQU6E3NN/nk
Malware Config
Extracted
quasar
3.1.5
SeroXen
feel-barcelona.gl.at.ply.gg:47655
$Sxr-GV6wZsGZZMeZ3qfenc
-
encryption_key
OyypB9RDbCUrmPK8uTim
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Anti-Malware Disable Startup
-
subdirectory
SubDir
Extracted
xworm
head-experimental.gl.at.ply.gg:46178
best-bird.gl.at.ply.gg:27196
super-nearest.gl.at.ply.gg:17835
wiz.bounceme.net:6000
-
install_file
USB.exe
Extracted
quasar
3.1.5
Slave
stop-largely.gl.at.ply.gg:27116
$Sxr-kl1r656AGsPQksTmi8
-
encryption_key
ql4fQ8TV9ZFP9vRX2myA
-
install_name
$sxr~Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
$77STARTUP~MSF
-
subdirectory
$sxr~SubDir
Extracted
asyncrat
Default
finally-grande.gl.at.ply.gg:25844
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Loader.exe
-
Size
409KB
-
MD5
808d880b4fc7f865fb607337690b5575
-
SHA1
7782ec3da7a6f8ed196d4431c59d50690580ac39
-
SHA256
90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962
-
SHA512
7a7ee833835d9469a1a5b48a5cbf9c902f362d82ad37b2ba99944e692b4322c140d770dc7be30f8ace7b84d6508e4d2e5f2007294ca3c07094bbfca8120ec6a8
-
SSDEEP
12288:KpsD64e1Muxkk3abqow6dL+32oJN/nSjCt1hw:OsG4kMUQU6E3NN/nk
-
Detect Xworm Payload
-
Quasar payload
-
Async RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1