Overview

overview

10

Static

static

10

2c6ab1efe2...d9.exe

windows7-x64

10

2c6ab1efe2...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7648bec482b7a6bb22407308c882cf12.bin

  • Size

    1.0MB

  • Sample

    240825-byr1ns1eje

  • MD5

    84bd54b678b1d3e7377d75bbdc8639e3

  • SHA1

    2012c3c9af120d4b6b70b19942076b1234b06ade

  • SHA256

    abea8fa09cecbf67474c4277e5c213d9ef3714996bff3fff5fcf1c286ffbc920

  • SHA512

    dcff0df4953c1577ace5089846062b12802f396cbda5044130aea739478fd40321ec65079fb2a924c123ddf3186ea5d7c7c0bb970475dd5952b0dd9458353232

  • SSDEEP

    24576:cpUEPqxIZpTcHsoYK/6IYWUtlCo6L9xr9SsQlv4e4iKi8Mm:oUEympgZYK/6jPqh9nQd0iK9

Score
10/10
azorultquasarebayprofilesdiscoveryinfostealerspywaretrojan

Malware Config

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443
Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Targets

    • Target

      2c6ab1efe207f8a2f8528ce232dcd1e2ff0b0dd82c5b460f51457a7bf97f60d9.exe

    • Size

      2.0MB

    • MD5

      7648bec482b7a6bb22407308c882cf12

    • SHA1

      edb98d630998a2852de05c4c2b5d9a3400f52418

    • SHA256

      2c6ab1efe207f8a2f8528ce232dcd1e2ff0b0dd82c5b460f51457a7bf97f60d9

    • SHA512

      085a3101e44213b06c8347cd61eca834d2b28f2506ce62e4658c1840f375b4e5faeeb54af8c6213b2fba08426536e8bf464376bff1ba8aa4f63049af07647686

    • SSDEEP

      24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYe:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y4

    Score
    10/10
    azorultquasarebayprofilesdiscoveryinfostealerspywaretrojan

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks