MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d016ad09b5362b12283b52164529321914d6e2d26dfdb011e5bf39d67855b3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d016ad09b5362b12283b52164529321914d6e2d26dfdb011e5bf39d67855b3e
SHA3-384 hash: e7d8788e248fb1b9ac0dc14200d82a40142b3267f32e496a9cefe5529ccd7be0e93a59d54e48ebd6e99ba7824ce8482d
SHA1 hash: 837141c5b6fcfa317146ba02900de948095c26db
MD5 hash: 36474ad64beab5c81c03c8d4ef859cd3
humanhash: texas-pluto-romeo-paris
File name:file
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:356'352 bytes
First seen:2020-02-28 03:00:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:FuqQ4i1FFiEKZ9ZOhNcbWz0zKHPxMNVwySKbNNF:Eplic/2+HZM3nbNNF
Threatray 77 similar samples on MalwareBazaar
TLSH 56748C1377A4DA3BD1FE5776E43206154BB0D417BA16F38F9A5896F82C123868E813B3
Reporter johannes
Tags:QuasarRAT


Avatar
viql
quasarrat via https://pastebin.com/raw/cnYybKBe

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-6295765-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Tinclex
Create hunting rule
Status:
Malicious
First seen:
2020-01-11 04:48:00 UTC
AV detection:
29 of 30 (96.67%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
025432a99764f95f01790ed77271c9f52c44bd6f08763d4ea77b81afbcad6485
QuasarRAT
06749098537b1e1e031e5d568e5e6d3f0bd89ca921953909b42c271b0a3fe5f0
QuasarRAT
0eaa5bbea25ef06214bc21deab41eb7f5bdcdd4c24b0297a28607d30edf65ae1
QuasarRAT
17a3a230d310ff684cf08306fe34d13c9505ac612942875a19c98b5d000119b0
QuasarRAT
2d3cf92d298fced13bf5f5d9feaf4b68294365bd89496f1bc064da7a418bda5f
QuasarRAT
2ea29fa9ad61f55762d2d1d3ce608c3fdfe4007802514042552293ce86af0454
QuasarRAT
45eb700e6848f246fbb010d66d6669083970a9fb54fec74e66f7c1d6ff5ca5e4
QuasarRAT
759650986713eaf7fe5021ead7a0994f33767c14b6a7caf1079379b087df21fe
QuasarRAT
7ce2be23716a01fd869e33ae99de79a9c74da78f19f0fcb930da4de5bce49885
QuasarRAT
d478602bac8b8f334f06644dd92fbe60cbba6815ced96503c7aab4df6f305e77
QuasarRAT
+ 67 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar spyware trojan
Link:
https://tria.ge/reports/201109-thkeeq1z6x/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Quasar RAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7d016ad09b5362b12283b52164529321914d6e2d26dfdb011e5bf39d67855b3e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments