MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553
SHA3-384 hash:	d5dc526787b1aea89e4cc2851af6ee6023875a5ff86444296244805f0837c0f2fa4f194a147169cc8d397895be30e375
SHA1 hash:	4499c621c1b9490964471092ef36875a1766c509
MD5 hash:	78cacdc4dcb91d88ca14927f37ab8b9c
humanhash:	paris-ohio-bacon-tennis
File name:	78CACDC4DCB91D88CA14927F37AB8B9C.exe
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	3'266'048 bytes
First seen:	2023-12-29 19:45:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	49152:6vDI22SsaNYfdPBldt698dBcjHVMRJ6cbR3LoGdnlTHHB72eh2NT:6v822SsaNYfdPBldt6+dBcjHVMRJ6m
TLSH	T13EE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
TrID	37.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 29.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 8.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 6.7% (.SCR) Windows screen saver (13097/50/3) 5.3% (.EXE) Win64 Executable (generic) (10523/12/4)
Reporter	abuse_ch
Tags:	exe QuasarRAT RAT

abuse_ch

QuasarRAT C2:
45.88.186.145:4782

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

344

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553.exe

Verdict:

Malicious activity

Analysis date:

2023-12-29 19:47:43 UTC

Tags:

rat asyncrat remote quasar

Link:

https://app.any.run/tasks/b88df151-d62c-4c9f-a6fb-ae080b3cc119

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

Win.Malware.Generic-9883083-0

Alert

Create hunting rule

Win.Malware.Msilheracles-9900242-0

Alert

Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Downeks-6898097-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a file

Setting a keyboard event handler

Sending a custom TCP request

DNS request

Using the Windows Management Instrumentation requests

Unauthorized injection to a recently created process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm certreq control crypto expand explorer hook infostealer keylogger lolbin quasar quasarrat rat remote replace schtasks stealer stealer

Link:

https://www.filescan.io/uploads/658f21fb7d4bdb7f8b002487/reports/a064aa0d-3954-46e4-b7d5-56aed9b287a1/overview

Hybrid Analysis Trojan.MSIL.Quasar

Verdict:

Malicious

Labled as:

Trojan.MSIL.Quasar

Link:

https://www.hybrid-analysis.com/sample/02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Quasar RAT

Malware family:

Quasar RAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/35d0b394-a955-421e-9821-8f14aa4ee7c7

Joe Sandbox Quasar

Result

Threat name:

Quasar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1368067

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553

CERT.PL MWDB quasar

Detection:

quasar

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Quasar

Threat name:

ByteCode-MSIL.Trojan.Quasar

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-27 19:37:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

2

AV detection:

20 of 23 (86.96%)

Threat level:

  5/5

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=alykp4me7tnkutm2i3fcs4jmrwvobjdnea4l2nrnzamaexpy2vjq._file

Threatray malicious

Verdict:

malicious

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:client spyware trojan

Link:

https://tria.ge/reports/231229-ygyhfsebck/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Executes dropped EXE

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

45.88.186.145:4782

UnpacMe QuasarRAT malware_windows_xrat_quasarrat win_quasarrat_j2 MALWARE_Win_QuasarStealer cn_utf8_windows_terminal INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA MAL_QuasarRAT_May19_1 INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_GENInfoStealer

Unpacked files

SH256 hash:

02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553

MD5 hash:

78cacdc4dcb91d88ca14927f37ab8b9c

SHA1 hash:

4499c621c1b9490964471092ef36875a1766c509

Detections:

QuasarRAT

Alert

Create hunting rule

malware_windows_xrat_quasarrat

Alert

Create hunting rule

win_quasarrat_j2

Alert

Create hunting rule

MALWARE_Win_QuasarStealer

Alert

Create hunting rule

cn_utf8_windows_terminal

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Alert

Create hunting rule

MAL_QuasarRAT_May19_1

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_GENInfoStealer

Alert

Create hunting rule

Link:

https://www.unpac.me/results/b119f4ab-155c-4d37-ba3a-67a16860a711/

VMRay QuasarRAT

Malware family:

QuasarRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/02f0a7f184fc/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/02f0a7f184fcdaaa4d9a46ca29712c8daae0a46d2038bd362dc818025df8d553