General

  • Target

    c0fa98a07c9a8be7d378b5fd2991aa5614b2378003af387b3fed110feba8821a.exe

  • Size

    2.0MB

  • Sample

    250111-gvb3yazrcn

  • MD5

    6936c1748121ea1b8bfa1625f3af7f67

  • SHA1

    8830014794742fd6fbd2dd1c6d3dcb99c694b89d

  • SHA256

    c0fa98a07c9a8be7d378b5fd2991aa5614b2378003af387b3fed110feba8821a

  • SHA512

    90b077ac5f0eddae517125d9c7a164859f4387137f90253204e86cc0ac98855ceb9ae4babbc5c863405e924e928fc8aaf8aaa7b09d739a3ebe1d83ecd7915edf

  • SSDEEP

    24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYF:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yj

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Targets

    • Target

      c0fa98a07c9a8be7d378b5fd2991aa5614b2378003af387b3fed110feba8821a.exe

    • Size

      2.0MB

    • MD5

      6936c1748121ea1b8bfa1625f3af7f67

    • SHA1

      8830014794742fd6fbd2dd1c6d3dcb99c694b89d

    • SHA256

      c0fa98a07c9a8be7d378b5fd2991aa5614b2378003af387b3fed110feba8821a

    • SHA512

      90b077ac5f0eddae517125d9c7a164859f4387137f90253204e86cc0ac98855ceb9ae4babbc5c863405e924e928fc8aaf8aaa7b09d739a3ebe1d83ecd7915edf

    • SSDEEP

      24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYF:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yj

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.