MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f
SHA3-384 hash: bdcae0266c1d99837dfeaa6625a1aeb59f9d40165a20c07ae91ef886ccf2984cc664da06660e5f11c40e880868dc1d96
SHA1 hash: a749c6ab791a98fa17cc7251c37cf41ed2ca4277
MD5 hash: 0e28531b24a9dea26005a84d0f9dfa94
humanhash: snake-winter-tango-saturn
File name:sexy.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:514'048 bytes
First seen:2022-07-24 21:56:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:0TEgdc0YpXbZvdo6EsRwd3OQRDZTP1bs2cEGpb8F9zTOjidcTR37:0TEgdfY/do6Yy2WWNCjidcd7
Threatray 1'991 similar samples on MalwareBazaar
TLSH T122B46B4023F8862BE5BE5779E87105205BF9F407B26BFB5F4541B0E92CA67069E40BB3
TrID 53.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
12.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.6% (.SCR) Windows screen saver (13101/52/3)
7.7% (.EXE) Win64 Executable (generic) (10523/12/4)
4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter Anonymous
Tags:exe QuasarRAT


Avatar
Anonymous
Retrieved from http://86.239.42.9:86/sexy.exe
QuasarRAT C2: djetdixipleshacker.ddns.net:4782 (86.239.42.9:4782)

Intelligence

File Origin
# of uploads :
1
# of downloads :
368
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/293830/
Detection(s):
Win.Malware.Generic-9883082-0
Create hunting rule

Win.Malware.Generic-9883083-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL
Create hunting rule

Win.Packed.Downeks-6898097-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Launching a process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware keylogger packed quasar quasarrat rat shell32.dll stealer
Link:
https://www.filescan.io/uploads/62ddc0337dd0cb902ff8b09f/reports/6b1e2515-b8dc-42e0-aee7-7bf11a79d9b3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dddfd56d-3c81-4908-8e7a-42e36ad2a1ef
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1040037
Signature
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 672531 Sample: sexy.exe Startdate: 24/07/2022 Architecture: WINDOWS Score: 100 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus / Scanner detection for submitted sample 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 5 other signatures 2->38 8 sexy.exe 5 2->8         started        12 sexy.exe 2 2->12         started        process3 dnsIp4 26 C:\...\WINDOWSREPAIRPROGRAMEFORVBUCKS.exe, PE32 8->26 dropped 28 C:\Users\user\AppData\Local\...\sexy.exe.log, ASCII 8->28 dropped 40 Uses schtasks.exe or at.exe to add and modify task schedules 8->40 42 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->42 15 WINDOWSREPAIRPROGRAMEFORVBUCKS.exe 2 8->15         started        18 schtasks.exe 1 8->18         started        30 192.168.2.1 unknown unknown 12->30 file5 signatures6 process7 signatures8 44 Antivirus detection for dropped file 15->44 46 Multi AV Scanner detection for dropped file 15->46 48 Machine Learning detection for dropped file 15->48 50 2 other signatures 15->50 20 schtasks.exe 1 15->20         started        22 conhost.exe 18->22         started        process9 process10 24 conhost.exe 20->24         started       
Detection:
quasar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2022-07-24 21:57:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwscqzpdxfldwalctb6zxkc2dd7g667pwkgttwxngj3ugq2heahq._file
Verdict:
malicious
Similar samples:
06d2c189a15e08cc0082d987e5ef9eee7cfe3c4518c2b5ce813a73e50eb68acf
QuasarRAT
4a3a8abd7f6d5fd9adfb51703085e839781cffc341705123be40b0c146dcf0a9
QuasarRAT
8e87ee714c27ec41f7d2cd0b5db7eb4d0dbb6b30da76f30172d17eef82f942da
QuasarRAT
991e1506dfacc786546d890dc72ed38393ce901592c60d236304998c8e7026d7
QuasarRAT
b72b56dbce5ed9e23036bc98d439f81d9768c49952297e44029bcd6607407616
QuasarRAT
f351d8782667176f51bd4b36b85e8ca3895a7583f445b77062d5fbf629d0d14a
QuasarRAT
+ 1'981 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:pd spyware suricata trojan
Link:
https://tria.ge/reports/220724-1txg2aabap/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Executes dropped EXE
Quasar RAT
Quasar payload
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
Malware Config
C2 Extraction:
djetdixipleshacker.ddns.net:4782
Unpacked files
SH256 hash:
15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f
MD5 hash:
0e28531b24a9dea26005a84d0f9dfa94
SHA1 hash:
a749c6ab791a98fa17cc7251c37cf41ed2ca4277
Link:
https://www.unpac.me/results/280d1c58-6c4d-4ba6-b716-e92662794678/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:MALWARE_Win_QuasarStealer
Create hunting rule
Author:ditekshen
Description:Detects Quasar infostealer
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Executable exe 15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/293830/

Comments