bc88e504c54b3000604e9916e6ddf1b9d61b86b5e8676635574d25338d1d7cad

General

Target
quatra.exe
Size 89KB
Sample260616-1ercgaex5m
SHA256 bc88e504c54b3000604e9916e6ddf1b9d61b86b5e8676635574d25338d1d7cad
MD5 945a29a0fa3ec44cc86ba49f6b534849
SHA1 bc45b7d19ff478824b8d24d1ff9ff903893fd288
SHA512 95a0f85892b9ffea49e44c5cb3af02b5364d7c92514705832254c49498b43ad32c24abc0f7316cea651b3bc64b164c889bbd280b64b6db2f9eceb50b4021e263
SSDEEP 1536:Leg29WxJj9RskhhJljHOPcUY59NzWZ2tJFtgEApyCU3n02UVvJWKOuW:ig2nZjE9CzDFO1
TLSH
T1C993088A5722DBFBD9008B35D4B70218FF35D1020B825EDB6D5541306F93BE98EA7B89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  quatra.exe
- Size 89KB
- SHA256 bc88e504c54b3000604e9916e6ddf1b9d61b86b5e8676635574d25338d1d7cad
- MD5 945a29a0fa3ec44cc86ba49f6b534849
- SHA1 bc45b7d19ff478824b8d24d1ff9ff903893fd288
- SHA512 95a0f85892b9ffea49e44c5cb3af02b5364d7c92514705832254c49498b43ad32c24abc0f7316cea651b3bc64b164c889bbd280b64b6db2f9eceb50b4021e263
- SSDEEP 1536:Leg29WxJj9RskhhJljHOPcUY59NzWZ2tJFtgEApyCU3n02UVvJWKOuW:ig2nZjE9CzDFO1
- TLSH
  T1C993088A5722DBFBD9008B35D4B70218FF35D1020B825EDB6D5541306F93BE98EA7B89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

bootkit discovery exploit persistence spyware stealer
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Possible privilege escalation attempt
  exploit
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
behavioral1 behavioral2