Overview

overview

10

Static

static

3

UMPDC(3).dll

windows10-2004-x64

10

UMPDC(3).dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    UMPDC(3).dll.exe
  • Size 181KB
  • Sample260528-m97faadw2k
  • SHA256 20e41f9151518c16eaaec357c16761d4dfebabb425ac727105a10020b34e169e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
donutloaderquasarxorium_stealerloaderspywarestealertrojan

Malware Config

Extracted

Family

  • quasar

Attributes
  • encryption_key

    F00D8BB24970E7D1F5959C85D7084E366FF0C645

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • reconnect_delay

    3000

Targets

    • Target
      UMPDC(3).dll.exe
    • Size 181KB
    • SHA256 20e41f9151518c16eaaec357c16761d4dfebabb425ac727105a10020b34e169e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    donutloaderquasarxorium_stealerloaderspywarestealertrojan

    • Detects DonutLoader

      loader

    • Detects XoriumStealer payload

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Family: XoriumStealer

      XoriumStealer is an information stealer written in C#.

      stealerxorium_stealer

    • Quasar payload

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks