quasar | 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
backup.exe
Size 3.1MB
Sample260503-gkp7tab151
SHA256 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c
MD5 1df13e8b6ae9577d292ffb2adb0119bc
SHA1 ebfbb4fb70f4fe2c0ba22ccc32f5a833f80714fb
SHA512 bac0d198bd7a91ceb78b6131660e75b3828918d96b7f3b1b6e5c50007dc4add85e4739166b69dab0658745f0debbdd4393868dbe32cfdbec1b7803161eceadc7
SSDEEP 49152:LvivE2H5aweBHPbl6T/yGaqA6/y5T72lpoGdhTHHB72eh2NT:LvoE2H5aweBHPbl6T/DaqA6/y5T7u
TLSH
T186E56A143BF85E32E16AD6B3D5B0505263F0F82AF363EB0B5181777A2D53B40A9426B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xoilac discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

xoilac

aidas.us:443
backup.aidas.us:443
trojan.aidas.us:443
ransom.aidas.us:443
phisher.aidas.us:443
malicious.aidas.us:443

Mutex

b074bb76-509d-4f22-9881-b2e406eacc36

Attributes

encryption_key
B7E4985BC6F561AFD5FC99CACB2E00523B40A73D
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/5428-0-0x00000000003C0000-0x00000000006E4000-memory.dmp	family_quasar
behavioral1/files/0x000a0000000243b6-5.dat	family_quasar

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	molliza.exe

Executes dropped EXE 10 IoCs

pid	Process
1200	molliza.exe
1684	molliza.exe
2288	molliza.exe
2848	molliza.exe
2400	molliza.exe
4348	molliza.exe
2512	molliza.exe
5660	molliza.exe
4704	molliza.exe
2720	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
216	PING.EXE
3632	PING.EXE
3868	PING.EXE
4248	PING.EXE
648	PING.EXE
5716	PING.EXE
5364	PING.EXE
3380	PING.EXE
6028	PING.EXE

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
3380	PING.EXE
6028	PING.EXE
216	PING.EXE
3632	PING.EXE
3868	PING.EXE
4248	PING.EXE
648	PING.EXE
5716	PING.EXE
5364	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5636	schtasks.exe
1860	schtasks.exe
740	schtasks.exe
5064	schtasks.exe
3960	schtasks.exe
5508	schtasks.exe
4768	schtasks.exe
2184	schtasks.exe
5192	schtasks.exe
2724	schtasks.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	backup.exe
Token: SeDebugPrivilege	1200	molliza.exe
Token: SeDebugPrivilege	1684	molliza.exe
Token: SeDebugPrivilege	2288	molliza.exe
Token: SeDebugPrivilege	2848	molliza.exe
Token: SeDebugPrivilege	2400	molliza.exe
Token: SeDebugPrivilege	4348	molliza.exe
Token: SeDebugPrivilege	2512	molliza.exe
Token: SeDebugPrivilege	5660	molliza.exe
Token: SeDebugPrivilege	4704	molliza.exe
Token: SeDebugPrivilege	2720	molliza.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 1860	5428	backup.exe	85
PID 5428 wrote to memory of 1200	5428	backup.exe	87
PID 1200 wrote to memory of 740	1200	molliza.exe	91
PID 1200 wrote to memory of 1068	1200	molliza.exe	93
PID 1068 wrote to memory of 2540	1068	cmd.exe	95
PID 1068 wrote to memory of 3380	1068	cmd.exe	96
PID 1068 wrote to memory of 2288	1068	cmd.exe	104
PID 2288 wrote to memory of 5192	2288	molliza.exe	105
PID 2288 wrote to memory of 3984	2288	molliza.exe	107
PID 3984 wrote to memory of 5372	3984	cmd.exe	109
PID 3984 wrote to memory of 6028	3984	cmd.exe	110
PID 3984 wrote to memory of 2848	3984	cmd.exe	112
PID 2848 wrote to memory of 5064	2848	molliza.exe	113
PID 2848 wrote to memory of 5404	2848	molliza.exe	115
PID 5404 wrote to memory of 3312	5404	cmd.exe	117
PID 5404 wrote to memory of 4248	5404	cmd.exe	118
PID 5404 wrote to memory of 2400	5404	cmd.exe	119
PID 2400 wrote to memory of 3960	2400	molliza.exe	120
PID 2400 wrote to memory of 5444	2400	molliza.exe	123
PID 5444 wrote to memory of 3416	5444	cmd.exe	125
PID 5444 wrote to memory of 648	5444	cmd.exe	126
PID 5444 wrote to memory of 4348	5444	cmd.exe	127
PID 4348 wrote to memory of 2724	4348	molliza.exe	128
PID 4348 wrote to memory of 3840	4348	molliza.exe	130
PID 3840 wrote to memory of 4576	3840	cmd.exe	132
PID 3840 wrote to memory of 216	3840	cmd.exe	133
PID 3840 wrote to memory of 2512	3840	cmd.exe	134
PID 2512 wrote to memory of 5508	2512	molliza.exe	135
PID 2512 wrote to memory of 3796	2512	molliza.exe	137
PID 3796 wrote to memory of 5312	3796	cmd.exe	139
PID 3796 wrote to memory of 5716	3796	cmd.exe	140
PID 3796 wrote to memory of 5660	3796	cmd.exe	141
PID 5660 wrote to memory of 5636	5660	molliza.exe	142
PID 5660 wrote to memory of 5588	5660	molliza.exe	144
PID 5588 wrote to memory of 888	5588	cmd.exe	146
PID 5588 wrote to memory of 5364	5588	cmd.exe	147
PID 5588 wrote to memory of 4704	5588	cmd.exe	148
PID 4704 wrote to memory of 4768	4704	molliza.exe	149
PID 4704 wrote to memory of 4892	4704	molliza.exe	151
PID 4892 wrote to memory of 4960	4892	cmd.exe	153
PID 4892 wrote to memory of 3632	4892	cmd.exe	154
PID 4892 wrote to memory of 2720	4892	cmd.exe	155
PID 2720 wrote to memory of 2184	2720	molliza.exe	156
PID 2720 wrote to memory of 1524	2720	molliza.exe	158
PID 1524 wrote to memory of 5308	1524	cmd.exe	160
PID 1524 wrote to memory of 3868	1524	cmd.exe	161

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\backup.exe
"C:\Users\Admin\AppData\Local\Temp\backup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1860
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mp363taA7Akw.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2540
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3380
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P9DYZENbLjHY.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5372
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6028
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lNMu70PD7RZv.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4248
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZgSBylc5KUJZ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:648
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\axo2N6VkzEnC.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:216
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2512
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKDseLzNv7JV.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:5312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5716
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SVVWxPrKysLn.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5364
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YNKfqdW7csCX.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3632
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2zsxTCtlMYWV.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5308
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3868

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

2zsxTCtlMYWV.bat

Path C:\Users\Admin\AppData\Local\Temp\2zsxTCtlMYWV.bat
Size 209B
SHA256 bf00a8f7c64beb639ae7ef3e6d5ce4adf9dfbce00224c922b4f5588785b5c01b
MD5 0dc96857c0941026396005405277903d
SHA1 fe5ddf533d355536201a03668e78f2538ae58aea
SHA512 b581f3f40b17cc19a8f74b1977400a98939ab56982b903df0938855af08ea5c6a282ca2d9cd2faae1e81875cfc2a9c0b3c069d28e72a00b60ea8b4f0aa0e782b
TLSH
T1C9D023011790C7DD45014C471EA172CCF05A04E71F4C7D9145058CBD0387C9CB557581
MD5 SHA1 SHA512 TLSH

Submit Download

P9DYZENbLjHY.bat

Path C:\Users\Admin\AppData\Local\Temp\P9DYZENbLjHY.bat
Size 209B
SHA256 8b144e68af025d53278b477ba5a56ac982f36dcbb16b5762466c413b4bc96948
MD5 fdd67031b66cab1569496c9be585d04a
SHA1 046a6577247084dbf5cfe4127f62ffe93104c835
SHA512 9114c1157379d62151fee0b0777adc67095f0c0a82462732b4603ad6ff33d0618b7bded0095fdd4794609a25996d1f3d59ac86fa37d9d38ef0b45bcfa154b1d8
TLSH
T1F7D023511B80CB5D49004C4B1EF5728CB05504E62F48BD914A014C9C038689CB6975C2
MD5 SHA1 SHA512 TLSH

Submit Download

SVVWxPrKysLn.bat

Path C:\Users\Admin\AppData\Local\Temp\SVVWxPrKysLn.bat
Size 209B
SHA256 30226957d21b688640cd0d074027e9cdae8aabc972c784c5c268bc43c23bd475
MD5 cd5dcf4b6c861d77daeca070a3397b41
SHA1 202e4da0c62c32964b02e2364f76775887bb7986
SHA512 0f1c01434e36880861088cdef34de41326da0bbe179f71dce488c2cd2ae2bc57b0d6097d62e6da903f13fa570b2caedc638855f41d6530242299f3625d24f3e4
TLSH
T121D023011780C75D55004C475F7A768CB05A04F71F487DD245048CDC03C6C8CB5975C1
MD5 SHA1 SHA512 TLSH

Submit Download

YNKfqdW7csCX.bat

Path C:\Users\Admin\AppData\Local\Temp\YNKfqdW7csCX.bat
Size 209B
SHA256 3573a26cb8cbe4c8b267b689bcdc8b68a245deaa4a14df8773c00cc1ed3a3cf7
MD5 cd321f9db0432becdcc038915889f515
SHA1 dada3a5e45b4ce36164bd1a767c380e0491311dd
SHA512 58a6501330ba537261e693ec937e2a7993f0f0121df166c9300a165e84a3f3d41b24e3a4ba0a08ce69f57fcb58e29f16f9114f893855d57817acc27768b19f6e
TLSH
T1C1D0231117C4CB5E45004C475EB1768CB09504F61F487DD185008C9C1386C8CB55B581
MD5 SHA1 SHA512 TLSH

Submit Download

ZgSBylc5KUJZ.bat

Path C:\Users\Admin\AppData\Local\Temp\ZgSBylc5KUJZ.bat
Size 209B
SHA256 86e2ecf300d3834cc6ad52f98900ab03de0acf7ed333b9a0544c5a0bc6f9fc84
MD5 22e37072dbc75b52bcb5d6bec93f12a5
SHA1 3d6f2ba7b9ad349b8066d9652f6bffaead52dfd1
SHA512 3876084ddcee4a9fb15280c0628e380dfa4c06d4aae1a35eaca16b3e2782550c123f0e52330af420efb31624a2fe9355a1046f52163d896497f2cdfb6c655007
TLSH
T182D0230117D1C76D450048476FA177CCB06604E61F4C7D92C5014C9C0386D8CF657581
MD5 SHA1 SHA512 TLSH

Submit Download

axo2N6VkzEnC.bat

Path C:\Users\Admin\AppData\Local\Temp\axo2N6VkzEnC.bat
Size 209B
SHA256 34299722e0ca028f5ea73d526c7587fb40bc8a3556a2268bf4f877da81c6cb03
MD5 fecd4ba36bc99ec837c5d3db4a43219e
SHA1 0f9eab47b42d4352424d502815ea71cdacc438b4
SHA512 8c7ef11d00432e1c8381926f6f7d8f20155ca61ff1035384f8b13fed37923ee40e4db5f1a9ea258914925edb6e4ebd20e5dee53600bed24884a88b41bc121964
TLSH
T136D023411790C79D5500484B1F6172CCB06504E62F4CFD9645004C9C078688CB5675C2
MD5 SHA1 SHA512 TLSH

Submit Download

cKDseLzNv7JV.bat

Path C:\Users\Admin\AppData\Local\Temp\cKDseLzNv7JV.bat
Size 209B
SHA256 4b01253d7cb5bd20b778ebeef234dc916ae3177b532b871879b77c0df20a755b
MD5 e59a9e1036a8115174d24f2c3bf54368
SHA1 734ac09c5d16a91ef733ccc945dcaaf779a8361e
SHA512 ffbce7538d1d85c4ddbda3903946cb931b661fe8f95de5787172864b2f47980079d54759952187e79fe66b27e6e684eac449ec1237cef6e1fde7412c988568b6
TLSH
T1B9D0234157C0C75D45408C4B1E61738CF09504E61F487D914D044C9D038689CB5A7582
MD5 SHA1 SHA512 TLSH

Submit Download

lNMu70PD7RZv.bat

Path C:\Users\Admin\AppData\Local\Temp\lNMu70PD7RZv.bat
Size 209B
SHA256 5e59700cc36431b8f53a7f0cc360186404fed6870d1bbab2673ad82aa272204d
MD5 bd09e93ee7f27de48ea09835cfcf015c
SHA1 85abab49a1366539bd80a64ca78066c41787432c
SHA512 f8c3d2dc2ccb0dabe293667229f428fb1d0fd7153f64391e6a8d11fd9a2bf1c123abff45d5b1ebdeec676ccd56d0dc8e870ebeb65b507921ee6a030bcccb1731
TLSH
T1F3D023021780CB5D450088471F61728DB05644F62F487D9145004C9D1386C9CB5575C1
MD5 SHA1 SHA512 TLSH

Submit Download

mp363taA7Akw.bat

Path C:\Users\Admin\AppData\Local\Temp\mp363taA7Akw.bat
Size 209B
SHA256 c805d32feaf361caea40a2a2e65a365eba0de61e18653c6406f32b2138b822f2
MD5 b08480eda25eced6f9b4c353422e357e
SHA1 b9c2eb033e65cb3e5c3aabbf73ac47752bac7437
SHA512 4cf6974ac4944d76ee0b597c46ec8519f8e674b76faefd6d0b4b13d53720dad31a9ae999ed7173ff3b3f2cc153aa9d3ed82a83b28c748df44ce1748577a0b9ca
TLSH
T1B1D023121780C79D45004C471EB1768CB09E04FA2F4CBDD146158C9C53C78CCB557581
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c
MD5 1df13e8b6ae9577d292ffb2adb0119bc
SHA1 ebfbb4fb70f4fe2c0ba22ccc32f5a833f80714fb
SHA512 bac0d198bd7a91ceb78b6131660e75b3828918d96b7f3b1b6e5c50007dc4add85e4739166b69dab0658745f0debbdd4393868dbe32cfdbec1b7803161eceadc7
SSDEEP 49152:LvivE2H5aweBHPbl6T/yGaqA6/y5T72lpoGdhTHHB72eh2NT:LvoE2H5aweBHPbl6T/DaqA6/y5T7u
TLSH
T186E56A143BF85E32E16AD6B3D5B0505263F0F82AF363EB0B5181777A2D53B40A9426B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-9-0x0000000002A20000-0x0000000002A30000-memory.dmp

Download

memory/1200-11-0x000000001B460000-0x000000001B4B0000-memory.dmp

Download

memory/1200-19-0x0000000002830000-0x000000000283C000-memory.dmp

Download

memory/1200-12-0x000000001BBD0000-0x000000001BC82000-memory.dmp

Download

memory/1684-14-0x0000000002DB0000-0x0000000002DBC000-memory.dmp

Download

memory/2288-25-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Download

memory/2400-34-0x00000000018A0000-0x00000000018AC000-memory.dmp

Download

memory/2400-39-0x00000000018A0000-0x00000000018AC000-memory.dmp

Download

memory/2512-51-0x00000000015A0000-0x00000000015AC000-memory.dmp

Download

memory/2720-69-0x0000000001050000-0x000000000105C000-memory.dmp

Download

memory/2848-31-0x00000000017F0000-0x00000000017FC000-memory.dmp

Download

memory/4348-45-0x0000000000E70000-0x0000000000E7C000-memory.dmp

Download

memory/4704-63-0x0000000001B50000-0x0000000001B5C000-memory.dmp

Download

memory/5428-0-0x00000000003C0000-0x00000000006E4000-memory.dmp

Download

memory/5428-8-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Download

memory/5428-1-0x000000001B440000-0x000000001B450000-memory.dmp

Download

memory/5660-57-0x0000000001730000-0x000000000173C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads