General

  • Target

    cd2fbad7de3454ead5efd638a3d42799665c7b3ec2a818f9aea661f96a6b27b2

  • Size

    2.0MB

  • Sample

    250128-d4879awnck

  • MD5

    37ec6a58666f4198cec32690f5efd70b

  • SHA1

    d91b490f7030bb64b7950dbf2a761ea49b301458

  • SHA256

    cd2fbad7de3454ead5efd638a3d42799665c7b3ec2a818f9aea661f96a6b27b2

  • SHA512

    40c304613abe69fef1668e629dbc8e5432ecb830fcd30254947a595bde0d2c004ee7e745e594eb3e6f0e88acd1daf68390ffab981d096346ed64349b75bd3391

  • SSDEEP

    24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY9:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443

Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Extracted

Family

azorult

C2

http://0x21.in:8000/_az/

Targets

    • Target

      cd2fbad7de3454ead5efd638a3d42799665c7b3ec2a818f9aea661f96a6b27b2

    • Size

      2.0MB

    • MD5

      37ec6a58666f4198cec32690f5efd70b

    • SHA1

      d91b490f7030bb64b7950dbf2a761ea49b301458

    • SHA256

      cd2fbad7de3454ead5efd638a3d42799665c7b3ec2a818f9aea661f96a6b27b2

    • SHA512

      40c304613abe69fef1668e629dbc8e5432ecb830fcd30254947a595bde0d2c004ee7e745e594eb3e6f0e88acd1daf68390ffab981d096346ed64349b75bd3391

    • SSDEEP

      24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY9:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Azorult family

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.