MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b
SHA3-384 hash: e075885888e4bcb9979a7ea21f335c1e3213d3d42a20726513b18aafa43b208833525c4d2c7709bad1d80c5b8d4e7c04
SHA1 hash: ee09f368f8bce749bf16be632f5cf5aa7d3fc68c
MD5 hash: 7ae1f804cca1745719576a8d55d0b62d
humanhash: ten-georgia-low-thirteen
File name:Gecikmiş ödeme.bat
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:380'027 bytes
First seen:2023-04-10 13:52:58 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 6144:92rqTM5mHX1FfB+NFBgCbnUP/yMlF/s+VotUptDiZki0FDuz6kc2PhKm9TgStLA9:3o5U1VqFBgCbU3y4poG/iZsB2PQkTLBK
Threatray 253 similar samples on MalwareBazaar
TLSH T1588412225E3BB555BC47CAAB3489876BEE918D4051CCE2F8F5C33D4B3249ED42AD2079
Reporter spatronn2
Tags:bat QuasarRAT


Avatar
spatronn2
Source : --> hxxps://www.mediafire.com/file/yqhn6iu48899fz9/Gecikmiş+ödeme.tgz/file/Gecikmiş ödeme.bat

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
TR TR
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
https://www.mediafire.com/file/yqhn6iu48899fz9/Gecikmiş+ödeme.tgz/file
Verdict:
Malicious activity
Analysis date:
2023-04-10 04:45:38 UTC
Tags:
evasion quasar
Link:
https://app.any.run/tasks/4f0a68f2-ca72-43a2-885b-35a02bab696f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
QuasarRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/381203/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/643414bf9868a43a8d2cff0c/reports/92a73a1b-0187-48cc-a719-31c7773dc1b1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1211100
Signature
Adds a directory exclusion to Windows Defender
Found potential ransomware demand text
Suspicious powershell command line found
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 844016 Sample: Gecikmi#U015f_#U00f6deme.bat Startdate: 10/04/2023 Architecture: WINDOWS Score: 52 29 Found potential ransomware demand text 2->29 8 cmd.exe 2 2->8         started        process3 file4 27 C:\Users\...behaviorgraphecikmi#U015f_#U00f6deme.bat.exe, PE32 8->27 dropped 31 Suspicious powershell command line found 8->31 12 Gecikmi#U015f_#U00f6deme.bat.exe 17 8->12         started        15 powershell.exe 7 8->15         started        17 conhost.exe 8->17         started        signatures5 process6 signatures7 33 Adds a directory exclusion to Windows Defender 12->33 19 powershell.exe 5 12->19         started        21 powershell.exe 5 12->21         started        process8 process9 23 conhost.exe 19->23         started        25 conhost.exe 21->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d57psflnc5tuupyupqoos47ypja7rsnqaz3ahtjpt5axw3d4f5vq._file
Verdict:
malicious
Similar samples:
579532a04b63aac5992010d56fa6cc982855b194d9782f5cfff3b063192a94d0
QuasarRAT
857217b72741e90dac37cfc2069753957841c31b224e6cd755c07833aa14dbe1
QuasarRAT
8a59fe8ca31ce4abde54d02705f65ed0d788e384e0d5c05441971f4d1fef5b34
QuasarRAT
9f253f6abcd703cb920e2825df26b468164d15ca2d50f154a5b12fbf84c05ca5
QuasarRAT
b6c8d4806e4080ddee5a5b5ff6f3f12074fae9bd31464a147c7ac6851755ca4c
QuasarRAT
cb1e7498dcbe72083463d95b8479c4182c1d90adfc1fd4b03b200850247798ee
QuasarRAT
d6674af0eeb02b8fd4723c1d79aef8e84541da7460b49ae7ad4f89d7d49c4000
QuasarRAT
+ 243 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230410-q6y7aabe2y/
Behaviour
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Malware family:
xRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f7ef9156d17/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Batch (bat) bat 1f7ef9156d17674a3f147c1ce973f87a41f8c9b0067603cd2f9f417b6c7c2f6b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/381203/

Comments