General
-
Target
Downloads.exe
-
Size
3.6MB
-
Sample
250331-cdy4xs1va1
-
MD5
d07a0825045c8467fee83e2b668e944c
-
SHA1
bff086232a40763ee1f6cf075bfa3626e7ecdf51
-
SHA256
89ec0cb73afbc666af8de174d6480611875e92a07fc38232bc41a0c63a3b0e89
-
SHA512
358da591a1176bb6258b41da4b095eef17186bd353c2852aeccce56d6cfc57ab812027cd2851b7b6f89b5dcbabc577289635e3e5dd354fd12a736a3f9a313f91
-
SSDEEP
98304:zzAu7vg+PONHdBcMyuNFBAkHOZhRaHPnIOMojlQjR9Zs1mIxYl2qq:zzAuTgKqHd1xshEPhHRaTa1jYl2qq
Static task
static1
Behavioral task
behavioral1
Sample
Downloads.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
Office04
102.41.58.213:5505
1e97a2db-0622-4c39-84ac-2f640c70aaf5
-
encryption_key
1F6CCF154B4C85A58D675CA9A482E9C7A041C879
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Extracted
asyncrat
0.5.8
Default
197.48.105.157:5505
41.233.14.164:5505
197.48.230.161:5505
102.41.58.213:5505
RW4mawavalFO
-
delay
3
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Targets
-
-
Target
Downloads.exe
-
Size
3.6MB
-
MD5
d07a0825045c8467fee83e2b668e944c
-
SHA1
bff086232a40763ee1f6cf075bfa3626e7ecdf51
-
SHA256
89ec0cb73afbc666af8de174d6480611875e92a07fc38232bc41a0c63a3b0e89
-
SHA512
358da591a1176bb6258b41da4b095eef17186bd353c2852aeccce56d6cfc57ab812027cd2851b7b6f89b5dcbabc577289635e3e5dd354fd12a736a3f9a313f91
-
SSDEEP
98304:zzAu7vg+PONHdBcMyuNFBAkHOZhRaHPnIOMojlQjR9Zs1mIxYl2qq:zzAuTgKqHd1xshEPhHRaTa1jYl2qq
-
Asyncrat family
-
Detect Umbral payload
-
Quasar family
-
Quasar payload
-
Umbral family
-
XMRig Miner payload
-
Xmrig family
-
Async RAT payload
-