aey8tp.zip
- SHA256 4275e4be5661a82faea8d38f02392ed220bc0078191295d9e5050a73b1b509e2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SiriusQT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
plugins/Clipper.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
plugins/Keylogger.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
plugins/RemoteDesktop.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
plugins/Stealer.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
stub/QuasarStub.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target aey8tp.zip
- Size 37.5MB
- Sample260907-a58rbstwbt
- SHA256 4275e4be5661a82faea8d38f02392ed220bc0078191295d9e5050a73b1b509e2
- MD5 6aaa603f9fba4a27c1baa5eb8cb7f44f
- SHA1 ae4e14f2c31eacaff192856dabaf9c43bc7dd317
- SHA512 492b6cb43c4d7c2bd0ae5b9a05c6459363a3f53683a93442667c1e87c8789cb918476d983fca0a1e8a79e0552e7268a9b9f2227fc5217237001540675b2886e7
- SSDEEP 786432:j1c+EJYu5PctFyOkYTj5nW7q7wQd5PctFyOkYTj5nW7q7wQe:j1+JY5tFzkIj5W7q7wQ4tFzkIj5W7q7K
- TLSH T18287334CF689C8D056A424D3839678EF93DFE099B891C997B15BDF30570206BE8A8C77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SiriusQT.exe unpack001/stub/QuasarStub.exe
File Explorer
-
aey8tp.zip.zip 37.5MB
-
Sirius.pdb1.1MB
-
SiriusQT.exe.exe 145KB
-
config.json4KB
-
css.png.png 15.8MB
-
plugins/Clipper.dll703KB
-
plugins/Keylogger.dll957KB
-
plugins/RemoteDesktop.dll1.6MB
-
plugins/Stealer.dll1.4MB
-
stub/QuasarStub.exe.exe 145KB
-
stub/css.png.png 15.8MB
Sirius.pdb
- SHA256 af328ce5c213ed7aac91b2c883e2e97ae3f40375dae25c3a3ef8f4b9051d1b13
- MD5 10b557516f4a47796e22c3aa041a0a4f
- SHA1 78e085fea2ca031a0ea2aee5abfe6a7152d6afa2
- SHA512 16b9883d2c551c0b3912c1a73b789745165453bab56a8d7fbfa8b1308567086ecd5cf305c5afc64ad44e018bf2f000a8b37f566b495f6458bfffeea264dc3053
- SSDEEP 24576:upfBCBMygmkzxzIVnRfJuVWbui98DadnLtbc2dNPSgPKH2PeVKKI58Dbw2bP:efB0gmMxz2lEONaA3PewtXWP
- TLSH T1104533384201C77D42D1C79AEBC6A26910A945FB29742F0564E6F110BAD08F2FB79F9F
- MD5 SHA1 SHA512 SSDEEP TLSH
SiriusQT.exe
- IMPHASH d921cb93ef4c91498be5398a9081fa8a
- SHA256 e6c26a82206f6d7f0d10702d93fbe44f2e5c288b033633a46ab65f0a23f186aa
- MD5 65d1096269abe9c8f3a19b174e68c471
- SHA1 c7d35a4f3157fe6310223032f784ffd408f7dee8
- SHA512 c5bbc745b8c0a7d17e302f9e5e8fa7480088454753f6db73fa2020558aba890a6cfeba9b40882be171924357d953dbd9ae3343714e66aa76a5d387a667ed6325
- SSDEEP 3072:sW/n5oqQmL6ykmIIgQF2Vw1aD859ftVl8L9Dm+vX:Z/KqTkmIIXGwUDAVOxv
- TLSH T184E3F707F7E521F8E477C23989A25626BB76B83407305AEF57504A3A2F227D0DE39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
38576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadFile
WriteFile
GetTempPathW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetFileAttributesW
SetProcessInformation
GetSystemDirectoryW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetModuleFileNameW
lstrcmpW
lstrcpynW
lstrcpyW
lstrcatW
lstrlenW
CopyFileW
MoveFileExW
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
DeleteFileW
CreateFileW
CreateDirectoryW
GetEnvironmentVariableW
CreateProcessW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
HeapSize
LCMapStringW
LoadLibraryExW
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsValidCodePage
RtlCaptureContext
RtlVirtualUnwind
GetConsoleWindow
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
user32
wsprintfW
advapi32
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptDecrypt
shell32
ord680
ShellExecuteExW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=35215,
count=7, id=259, version=35215,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=13, id=260, version=35215,
count=13, id=257, version=35215,
count=123, id=1, productName=Unmarked objects,
count=1, id=260, version=36248,
count=1, id=261, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
config.json
- SHA256 015bc909d1d7e916c61c871de488292a89abcbc3646c0a44c1e40d5a159a368b
- MD5 26325b5bf4de6f60d0d756c5f5fb2477
- SHA1 b91e817948873e63518302505013086f9aef7213
- SHA512 99ad34de7836c46613a4d0e1a42bb4a01bbfc6240dfd0cb82047a229763abcf1da8892120d95d8a09b54b9abc54d94b59a45f61b3bd23c6027fdb466c4363a30
- SSDEEP 96:aEdlcVAzLzMeTJRYPrD78arCIDVDXUD2ArrCvlT:hdlXPJTPYbjdDXaNrCvV
- TLSH T173816DE25EF3264C33D8E572505AADF5CD4B81773B13528AD93112C0978597DE9AB00A
- MD5 SHA1 SHA512 SSDEEP TLSH
css.png
- SHA256 7d64363ec16d4b6f357bc9640ef014567b9639ab0423501075c905470efcafb3
- MD5 0b718ed2321730a0a2559da810d1b6ad
- SHA1 1c358eb0978853a91a9b360ef7d59a586fcfa308
- SHA512 50280342e89d7afe74f0aa59ab762a5569afe30d271326b596034325884e29ff37fe5bb724fc64f54a90bf444e65112fdac1a32488230ec24d13d522cc5dd6d4
- SSDEEP 393216:4bJfIZjvn4GHBJQY/avN6li7Y2UE4PGyR69v20AjSSSiZu/iu:iJf6/lUg0YlnL3SFiZuqu
- TLSH T144F6334CF799C8D159A824D382DAB4EF93CFE098F491C893B24ADD75471206BE898C77
- MD5 SHA1 SHA512 SSDEEP TLSH
plugins/Clipper.dll
- SHA256 5b8814c54179211d807df804f60db42bef9f9dc2d308dd6c76c45202d689285e
- MD5 8e7d001063429957f280ca59a6fd13ff
- SHA1 f3c378fa1aad749560f1d8c77eb4237723e84660
- SHA512 f21cdf6c0b49c09fcb8bbe49f33fb507956687c16e1a1c415950049046d284e5613d1000350a9894a0a756b70ee9c76402f23422cc5d3a1315b2871e7601335c
- SSDEEP 12288:o9pUnCzIsc1Nbs/KNUbF5ushMzMnmwCgk8Of7nltC0jTKLfuI/WWTf7Vf3Xeft1e:o9pQQId+vh5SMvCguTl9TKbH/PThQt1e
- TLSH T1E9E423CC34CA46249B16D6CF3916A8481CFE74F28D6F5A59A261FA001F85CD4E7B4CAF
- MD5 SHA1 SHA512 SSDEEP TLSH
plugins/Keylogger.dll
- SHA256 b0ee3bd8ba9fef180915d1836ed96587c0a9295efee1eff19f458640f80da688
- MD5 57ffc93dc445e29698c08a0ada6118bc
- SHA1 e9d0649d72371b3dea9da63be152331af2655ac8
- SHA512 91ee1996ede9a873e7fc48967a4aca76c054e3f7e07f652474a2f0eb323f82327c58c597e7c244e0251d9191cfa10a04770cf9e0bbf55f716c558a346d30351e
- SSDEEP 24576:EHO9ipLCi07HsCNB/eTC6XnGRJyJ7NitFD24DaZHqBOe:uOUpLp0rsoB2TbXGRJyZNkF6MBOe
- TLSH T1292533226D00D52D4B222551FFA2E3AB422B3C262DDEFC8E99BB145DD9C534C3B8C575
- MD5 SHA1 SHA512 SSDEEP TLSH
plugins/RemoteDesktop.dll
- SHA256 61f81d700b74a80c96af4310705867e1abee49991ffb173a549fb3fe87ca25a8
- MD5 0a683c30b7d11bf44489f08691451323
- SHA1 5759e1497385aa2e21c57e887bd63bd955c51a7b
- SHA512 dd213f8c6b8961a46c27357a38c651a993920c2c731a5c9adaf4a14039690928389c9fc6c5fe54a906e293739c1ed199f3132f6b28827596c6e5b80742b5839f
- SSDEEP 24576:Zr9bwc5NlRQohMj5cgoDubslQjZYsrl4hGUjS80tLYqnqppRy+5BIY3/A4K18G6:Xbwc5NlSyMj5ho6s+jZnUjC6y+z34Pv6
- TLSH T143753303F45D060DE5A373A74E322E0CC6E094D63C5B5D29B5A3AE39592B02E497F72B
- MD5 SHA1 SHA512 SSDEEP TLSH
plugins/Stealer.dll
- SHA256 848f9733fd3b604aba4ca83fb18233e0a82c13fa6e24db079d7a5982fb1ef7a5
- MD5 c922103391dccc8838871b80239f6a0c
- SHA1 7d676ee4024aff591b58a75f1812475802c74085
- SHA512 43015e60dee8737c3ecab9337ed6468c8eb4d53057fc37227a2251136c9e7e83250ceaa485457d38325d1e715d4966f7b2964e4fdf0fa39bddf7fe5a96248160
- SSDEEP 24576:reZ94A/Ev3j12FrD5qwqPZVbdJM8qJMteq66fDLXHe7EMFCQE7/SX:uiAcQrD5YP/3qJrIP+7xFCQE7u
- TLSH T18265338C5DD5208E2A54E768F221324A764CBE43B5D9E3AA21574EF011843F0ED7DABB
- MD5 SHA1 SHA512 SSDEEP TLSH
stub/QuasarStub.exe
- IMPHASH d921cb93ef4c91498be5398a9081fa8a
- SHA256 e6c26a82206f6d7f0d10702d93fbe44f2e5c288b033633a46ab65f0a23f186aa
- MD5 65d1096269abe9c8f3a19b174e68c471
- SHA1 c7d35a4f3157fe6310223032f784ffd408f7dee8
- SHA512 c5bbc745b8c0a7d17e302f9e5e8fa7480088454753f6db73fa2020558aba890a6cfeba9b40882be171924357d953dbd9ae3343714e66aa76a5d387a667ed6325
- SSDEEP 3072:sW/n5oqQmL6ykmIIgQF2Vw1aD859ftVl8L9Dm+vX:Z/KqTkmIIXGwUDAVOxv
- TLSH T184E3F707F7E521F8E477C23989A25626BB76B83407305AEF57504A3A2F227D0DE39B50
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
38576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
ReadFile
WriteFile
GetTempPathW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetFileAttributesW
SetProcessInformation
GetSystemDirectoryW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetModuleFileNameW
lstrcmpW
lstrcpynW
lstrcpyW
lstrcatW
lstrlenW
CopyFileW
MoveFileExW
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
DeleteFileW
CreateFileW
CreateDirectoryW
GetEnvironmentVariableW
CreateProcessW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
HeapSize
LCMapStringW
LoadLibraryExW
VirtualProtect
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
IsValidCodePage
RtlCaptureContext
RtlVirtualUnwind
GetConsoleWindow
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
user32
wsprintfW
advapi32
CryptImportKey
CryptSetKeyParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
CryptDecrypt
shell32
ord680
ShellExecuteExW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=142, id=261, version=35215,
count=7, id=259, version=35215,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=13, id=260, version=35215,
count=13, id=257, version=35215,
count=123, id=1, productName=Unmarked objects,
count=1, id=260, version=36248,
count=1, id=261, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
stub/css.png
- SHA256 7d64363ec16d4b6f357bc9640ef014567b9639ab0423501075c905470efcafb3
- MD5 0b718ed2321730a0a2559da810d1b6ad
- SHA1 1c358eb0978853a91a9b360ef7d59a586fcfa308
- SHA512 50280342e89d7afe74f0aa59ab762a5569afe30d271326b596034325884e29ff37fe5bb724fc64f54a90bf444e65112fdac1a32488230ec24d13d522cc5dd6d4
- SSDEEP 393216:4bJfIZjvn4GHBJQY/avN6li7Y2UE4PGyR69v20AjSSSiZu/iu:iJf6/lUg0YlnL3SFiZuqu
- TLSH T144F6334CF799C8D159A824D382DAB4EF93CFE098F491C893B24ADD75471206BE898C77
- MD5 SHA1 SHA512 SSDEEP TLSH