Overview

overview

10

Static

static

10

autodist_p...2).zip

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    autodist_proproctor_M2 (2).zip

  • Size

    34.9MB

  • Sample

    241113-vq9ejawcqb

  • MD5

    38cbe4bfde65070ccbd42fd6d4fd7517

  • SHA1

    a6c8e7cea56ffe8eae93db6128f440cfdf7078e7

  • SHA256

    8e42aaf1c038c992a57bbeb607e21df8d7d2f40248c5b35cd431cac0a1b5c77f

  • SHA512

    251405e6b4885f2e72be95494609899c7fbd51371e5389c9d3bfdbca7201af24a4ba3724ba409c9837960277194115575c3538c921afde456b96cd763b8d0c15

  • SSDEEP

    786432:qK3WRVP/LiO0hSfYxv73lwlOxWyr4Rp73lwlOxWyr4RMst9:qK67iOwSf+73lxxWyrCp73lxxWyrCMc

Score
10/10
quasardiscoveryevasionpersistencespywaretrojan

Malware Config

Targets

    • Target

      autodist_proproctor_M2 (2).zip

    • Size

      34.9MB

    • MD5

      38cbe4bfde65070ccbd42fd6d4fd7517

    • SHA1

      a6c8e7cea56ffe8eae93db6128f440cfdf7078e7

    • SHA256

      8e42aaf1c038c992a57bbeb607e21df8d7d2f40248c5b35cd431cac0a1b5c77f

    • SHA512

      251405e6b4885f2e72be95494609899c7fbd51371e5389c9d3bfdbca7201af24a4ba3724ba409c9837960277194115575c3538c921afde456b96cd763b8d0c15

    • SSDEEP

      786432:qK3WRVP/LiO0hSfYxv73lwlOxWyr4Rp73lwlOxWyr4RMst9:qK67iOwSf+73lxxWyrCp73lxxWyrCMc

    Score
    10/10
    quasardiscoveryevasionpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks