MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55
SHA3-384 hash: 62aeb25999d94818a3fc35836ab35d56343371c2a83a40aba07c4a7df3a47a34300509940e51d1fbfab6089ee1f4b94a
SHA1 hash: 903f73ec625e3a8ca291f369c5e0efe1e24e3e72
MD5 hash: f9bbc48fa75a646f11a8771c5eadfc91
humanhash: princess-hydrogen-floor-seven
File name:xg6hsb6VyKuk.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'085'952 bytes
First seen:2023-06-20 13:49:30 UTC
Last seen:2023-06-21 17:04:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:1Cynkc1ZzBvtrZHFjMKY29kpj4elz781eHGp:wynkc1ZzBvtrZHFjMKY2G4el3VH
Threatray 20 similar samples on MalwareBazaar
TLSH T17A353A14F7F855A5F06E7F32747158050A38FE07697DDB4B2B96A1980A6A380CCB2F63
TrID 53.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
12.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.5% (.SCR) Windows screen saver (13097/50/3)
7.6% (.EXE) Win64 Executable (generic) (10523/12/4)
4.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter pmelson
Tags:exe QuasarRAT VoidRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
323
Origin country :
US US
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
xg6hsb6VyKuk.exe
Verdict:
Malicious activity
Analysis date:
2023-06-20 13:51:11 UTC
Tags:
evasion quasar rat
Link:
https://app.any.run/tasks/cf05bb3d-9697-4caa-8c12-cb7d33a38647

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
QuasarRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/401117/
Detection(s):
Win.Malware.Ursu-9802322-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Sending a custom TCP request
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Creating a file
Launching a process
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cmd.exe cmstp.exe evasive evasive explorer.exe fingerprint fingerprint keylogger lolbin lolbin net netsh.exe packed packed quasarrat rat reg regasm.exe schtasks.exe stealer update.exe
Link:
https://www.filescan.io/uploads/6491ae8b63e40cba68018cec/reports/5f9c00d5-3f7f-4f50-9608-10aeb9e2d77e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/588b0ead-b822-4c3f-a96a-cbb1cb6b7086
Result
Threat name:
Clipboard Hijacker, Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1258273
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to hide user accounts
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Generic Downloader
Yara detected Quasar RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 891294 Sample: xg6hsb6VyKuk.exe Startdate: 20/06/2023 Architecture: WINDOWS Score: 100 68 Snort IDS alert for network traffic 2->68 70 Multi AV Scanner detection for domain / URL 2->70 72 Found malware configuration 2->72 74 15 other signatures 2->74 8 xg6hsb6VyKuk.exe 15 13 2->8         started        process3 dnsIp4 58 ip-api.com 208.95.112.1, 49699, 49701, 80 TUT-ASUS United States 8->58 60 pastebin.com 172.67.34.170, 443, 49700 CLOUDFLARENETUS United States 8->60 62 192.168.2.1 unknown unknown 8->62 54 C:\Users\user\AppData\Roaming\Venom.exe, PE32 8->54 dropped 56 C:\Users\user\...\xg6hsb6VyKuk.exe.log, ASCII 8->56 dropped 80 May check the online IP address of the machine 8->80 82 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->82 13 Venom.exe 14 7 8->13         started        17 cmd.exe 1 8->17         started        file5 signatures6 process7 dnsIp8 64 indigo22.ddns.net 194.147.140.137, 49702, 7171 PTPEU unknown 13->64 66 ip-api.com 13->66 84 Multi AV Scanner detection for dropped file 13->84 86 May check the online IP address of the machine 13->86 88 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->88 90 Installs a global keyboard hook 13->90 19 powershell.exe 7 13->19         started        22 powershell.exe 7 13->22         started        24 powershell.exe 7 13->24         started        34 29 other processes 13->34 92 Uses ping.exe to sleep 17->92 94 Uses ping.exe to check the status of other devices and networks 17->94 26 conhost.exe 17->26         started        28 PING.EXE 1 17->28         started        30 chcp.com 1 17->30         started        32 xg6hsb6VyKuk.exe 17->32         started        signatures9 process10 signatures11 76 Uses cmd line tools excessively to alter registry or file data 19->76 78 Uses schtasks.exe or at.exe to add and modify task schedules 19->78 36 conhost.exe 19->36         started        38 reg.exe 19->38         started        40 conhost.exe 22->40         started        42 reg.exe 22->42         started        44 conhost.exe 24->44         started        46 reg.exe 24->46         started        48 conhost.exe 34->48         started        50 conhost.exe 34->50         started        52 56 other processes 34->52 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55/
Threat name:
ByteCode-MSIL.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2023-06-20 13:50:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
27 of 37 (72.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqya3jk3neqsj6hp5wstaxmg2tribo5xqxvipt7usi45yatkprkq._file
Verdict:
malicious
Similar samples:
0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7
QuasarRAT
11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e
QuasarRAT
547679ede9037e0edceeaa3e10b5f9ba6b8af47e6a3fa38b825c769005f182ef
QuasarRAT
70da0f06cb454d93d73583cda4ecd7e33fcf788d3ea4cec57aa06c00670bb682
QuasarRAT
c1b7c826bcd46069430612557a69fdf0d99ee79015067c8f251bdc81df1d2c5c
QuasarRAT
d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16
QuasarRAT
eaffa2b674b3afc1110ddd54a2835ebe59ed686a564f256dccb40b3bac1010ca
QuasarRAT
+ 10 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:indi evasion spyware trojan
Link:
https://tria.ge/reports/230620-q48ypsdf3s/
Behaviour
Modifies registry key
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Modifies security service
Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
indigo22.ddns.net:7171
Unpacked files
SH256 hash:
d740f5f7d022ef123429a57222e5597047c2ce7b0709c1c196e5a55487947e4a
MD5 hash:
9bea6249ccb58a6df146180a46e04e95
SHA1 hash:
8563d51d755934068be7cd3a000875917c0cf2eb
Link:
https://www.unpac.me/results/1b2d932c-1822-4218-86df-98991bbb9e14/
SH256 hash:
1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55
MD5 hash:
f9bbc48fa75a646f11a8771c5eadfc91
SHA1 hash:
903f73ec625e3a8ca291f369c5e0efe1e24e3e72
Link:
https://www.unpac.me/results/1b2d932c-1822-4218-86df-98991bbb9e14/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c300da55b69/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defedner features
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding command execution via IExecuteCommand COM object
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:malware_Quasar_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:MALWARE_Win_DLAgent09
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:MALWARE_Win_QuasarRAT
Create hunting rule
Author:ditekSHen
Description:QuasarRAT payload
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Description:Detects QuasarRAT malware
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:pe_imphash
Create hunting rule
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_NET_Msil_Suspicious_Use_StrReverse
Create hunting rule
Author:dr4k0nia, modified by Florian Roth
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Executable exe 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55

(this sample)

  
Link
https://www.virustotal.com/gui/file/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55/detection
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/401117/

Comments