MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 1 Yara 1 Comments

SHA256 hash: 0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9
SHA3-384 hash: 6f083c3f8eae80310b833a0b83acb6d24c0555e427ce042bf3809a867d051f5cb31dfae49eea57d95d70340b600814bf
SHA1 hash: c8248b016315f79cac43e5dd17c677f33b0042e1
MD5 hash: 1930ca258642f47145ba36729c6fbc6f
humanhash: jersey-cold-georgia-sierra
File name:0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9
Download: download sample
Signature QuasarRAT
File size:1'671'680 bytes
First seen:2020-06-30 06:54:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 49152:R/B+K2glMitdGBRtNbV6HUcfbNJolBT7R1a0H6eOu:hB5FtUDx5cfJ2lBBGeOu
TLSH F375232476992C3FCABC14F688852D4507F1A9A53B43F7CACDCD605D18D6FC84682ABB
Reporter @JAMESWT_MHT
Tags:QuasarRAT

Intelligence


Mail intelligence No data
# of uploads 1
# of downloads 30
Origin country IT IT
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/16843/
ClamAV SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 00:58:26 UTC
AV detection:24 of 31 (77.42%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   7/10
Malware Family:n/a
Link: https://tria.ge/reports/200630-7ng7rgabda/
Tags:spyware discovery persistence
VirusTotal:Virustotal results 19.44%

Yara Signatures


Rule name:Quasar_RAT_1
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments