MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557
SHA3-384 hash: 7bc1c4006c0854d18992f6d65cb0a4d13ad7e54805779cb98f45bd8cc263e52c643c6f13bff9aefe91ff3744d1a871d7
SHA1 hash: 9bbd320ae5901ba787cb5ecef1d71bef332d3e66
MD5 hash: c97c519b7b00a60d9dd9f8ced68c5c2b
humanhash: floor-island-high-helium
File name:swift.img_20220930_011_001.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:761'856 bytes
First seen:2022-10-02 11:42:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:nu2iNq4nBuC43I3mQxtri2ti2NYl8so/PaSsiMWQunh3:u1lQ342QfrzYlsbFEa
Threatray 1'111 similar samples on MalwareBazaar
TLSH T169F4D0361BEB8E07C1256679C1D0C6B6A7AACD01E163C2D76BCA1D1FF0877B687A0351
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter cocaman
Tags:exe QuasarRAT SWIFT

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315739/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.389.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bcdf0725-d2b2-4550-af8c-58f5e53278f3
Result
Threat name:
BluStealer, SpyEx, StormKitty
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1081891
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected BluStealer
Yara detected Generic Downloader
Yara detected SpyEx stealer
Yara detected StormKitty Stealer
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 714448 Sample: swift.img_20220930_011_001.exe Startdate: 02/10/2022 Architecture: WINDOWS Score: 100 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for dropped file 2->41 43 Sigma detected: Scheduled temp file as task from temp location 2->43 45 12 other signatures 2->45 7 swift.img_20220930_011_001.exe 7 2->7         started        process3 file4 27 C:\Users\user\AppData\...\qfnkeztGEzHx.exe, PE32 7->27 dropped 29 C:\Users\...\qfnkeztGEzHx.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\Users\user\AppData\Local\...\tmp4741.tmp, XML 7->31 dropped 33 C:\...\swift.img_20220930_011_001.exe.log, ASCII 7->33 dropped 55 Uses schtasks.exe or at.exe to add and modify task schedules 7->55 57 Adds a directory exclusion to Windows Defender 7->57 59 Injects a PE file into a foreign processes 7->59 11 swift.img_20220930_011_001.exe 1 7->11         started        13 powershell.exe 21 7->13         started        15 schtasks.exe 1 7->15         started        17 swift.img_20220930_011_001.exe 7->17         started        signatures5 process6 process7 19 AppLaunch.exe 15 3 11->19         started        23 conhost.exe 13->23         started        25 conhost.exe 15->25         started        dnsIp8 35 icanhazip.com 104.18.114.97, 49697, 80 CLOUDFLARENETUS United States 19->35 37 114.82.9.0.in-addr.arpa 19->37 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->47 49 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->49 51 May check the online IP address of the machine 19->51 53 2 other signatures 19->53 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2022-09-30 02:49:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=exco4cbdq45nb2p62eunz62f5o4cd7t2c7bzmatlrwf6dqsaavlq._file
Verdict:
malicious
Similar samples:
547e11f854149b57fd150f999595def28a46ce48d71b78dd3bf3310caeb18fdb
QuasarRAT
56589d4ad6f44f446964d2fa294809ca1e1ed2536b6c4f51edc4d0d8fc736a53
QuasarRAT
835895ee89c69f1fd6b85b8b755d4ec1ae178bfa90a2a056b684b7dd43131f05
QuasarRAT
95c0369a04185f31bedf1c33add90bc3f06b0b68f54e643992410c39d13617e1
QuasarRAT
cd38bbc0668699fe1761de97d8dd736321a219e5cf99767bb1f0dd81a2c03bcc
QuasarRAT
d3623467be7b5da036e415283f4bc70441e4167d1c345acd2b0e761845032093
QuasarRAT
da67541015af6ddee5bad1432ecc3efbf85cde69c494fd1635edbae606c4a628
QuasarRAT
dda40af7e530bf5744b1ae2219bcf10b8457f18c6a8ef39e9423badaf30beec4
QuasarRAT
+ 1'101 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:blustealer family:stormkitty collection stealer
Link:
https://tria.ge/reports/221002-nvkhmsfaaq/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
BluStealer
StormKitty
StormKitty payload
Malware Config
C2 Extraction:
https://api.telegram.org/bot5732817033:AAFBYIIZmJ7NuvVwD7WRcbV9qwcOqT7RpwM/sendMessage?chat_id=1638137774
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/cfa78edc-de69-4835-8a82-6a415e01f144
Unpacked files
SH256 hash:
01db825b7aaf0ef10098db023b284bbe71dcc1fa565c4c7ea347f36554eb24a9
MD5 hash:
ba31730ff655be9d3306bd72d152e12b
SHA1 hash:
c95dfb41da776e8150f12358d083b20d8915610e
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
SH256 hash:
16a775ae7240434e0563eeb9220c0fb4d2352251d4483d08d9d9678f2b743f1c
MD5 hash:
cb51286b55d81634de24cdf0fa2bd358
SHA1 hash:
af50caf6cc4ba374d63911031491fc846ce443db
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
SH256 hash:
2470b39032f6182252039c88199016566b0de30c6aa02163a143427afedd12af
MD5 hash:
c3a1924684ca30ed22234ce1d9111dfc
SHA1 hash:
7347706241422758c06440fd6044ae4e042b456b
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
SH256 hash:
7e4843761e222e22f93096e79781c52effc1ce5e9b8d896447707c97c34d2855
MD5 hash:
d160abe382496663b4936795c9a8771a
SHA1 hash:
4d690aa57694a5b2e85b8ac7886ce2313c1fb0f5
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
SH256 hash:
c09affd5fddb9ca441374ffb348376e6f25b9fc4ffa7e4da29fbbdca4c32c043
MD5 hash:
f77ab6497bbf34bc635dc4f790c02ead
SHA1 hash:
416e499335a6dda176d50f532a4c7f067d1d178f
Detections:
win_agent_tesla_g2
Create hunting rule
win_masslogger_w0
Create hunting rule
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
Parent samples :
a4d4f86889b389430e83bf9d7829e1c9488ac55bd4f9d226e1cc739fe43e54ec
2b661a8e53810cefbc9c2bb09e3aeea5607e6195160f3902bbf2ea7581ec82b5
836cd10659a3fca29d754c77b76c305f6a829e3f44efd9672b82c217628c49eb
66c646381997538bca27a7468229257a02527852ac897ca04d6ea52c3cad82ac
8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4
308f40c19bcd4f58f5dc1e83713d91a80a2ac8f78b5e03501db556f94c946149
284ce975050009d5c7bce4ad0c02f03a4cf70bad620e10822a4f4ad65e567127
29dbbf1bffa1c271158334e05721f8a7fb76513d5ba0d8c5a5abe267cccdbe4b
e68526e8ebc0cb1342ed01317aa6966d83bea1b71b1285b55b653a512200304c
d178525a986175d484866facf95baa1573a63a1060e5a06346ee4da4932df656
d5adba5715cd10a3c9dcf11d7ab1e30834050eef7513bda558bfe39a53a364ac
6731f235ff78e22e5a0f1503542926bb707a95251b8cbd22c56fbd7fc5a8cbbf
b5141a3c6323449bc7fc031d6eb2073fcbe97754c46eef0d0d8f937b9c2fb5cb
2d127dea1f6345c2027dbf93c109f7d7758f5bb396c9d47caa593a5039c05778
2bf197104a6418c886f206755e3f599ae9b1f90cf9771be981c30f427ecb228c
3704c9065de2c596066dbca893c63b1d12b9264d62cffd92ffc49aaf919b49a5
98d37790e570afd49b7a00192019f6c9e7c84e96069da4daa1b64a6cc88695a8
4a4d5455c9e941082c8c08a96102afc9d33abc40985bfcc00b6bee8c098066fd
0aa8c16926f65f1882953c640bcd56c9ca2ed25b1d35461d07d79d47cbdc60af
04ed81e966c2ed610dea41efe3251e15ad3a9a899ae27a81c02e9950e4367306
3e1cab8195206e7bf50b34dde56656e54ab25af5fe4136f1f76fc60f7664fd79
2c38354b88fee401ab4d9ca00979e23b39237bd81f19f7c668161da5cdda6be5
3cc67ef9b1c9978bc823e77db86d092e9f1df3062c4d98fc668920b7d7534122
db8326300154e132bca39bb24e89949dbe41c9af90d9f10242dce3f9423ab094
8ae01f38de83a0fa5f9c1dfe88fbcc594b779a8e4457bbe7ec046d541696a11a
430a9487d85e5998d134ca3a890e0c6ff86101264d1fc4ae869953fac0755c3e
da67541015af6ddee5bad1432ecc3efbf85cde69c494fd1635edbae606c4a628
dda40af7e530bf5744b1ae2219bcf10b8457f18c6a8ef39e9423badaf30beec4
25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557
077c6dc697fe099f49f24e345aa6dff6ede9be899e28906f856111b5ce364b14
1488d2bb17e28439602d2b7e015761b040a36cc2951f01ec2afd6a9cb4e788e7
2165ab6a605c5ba4e532f63ceed296bafd826ba122cbc8f6422b01d737e1a126
3bb532a1c042b56a70ab6bdfc4d7ac5daf8637a34455b84f2b1e910534a8e026
fd10d0c124ace345aaace7bab115d0cd3771c61919912e141924991146fc6b37
16f2160476b2c78ec35b8fd9a4430b865cf3597c0da23795181196ea682f3df0
9ba020588bb1e8787177acbe57fd14f643519cf3b58532111015f7402d12bfdc
0cd6df14b5d34f847a65f9f9ba0137472f684ff494084283f21bbd1e27bce4f2
1ad0802a8ec7e2b02a912133947517e4b4b610426c5e278736e9de706956a97c
81d63eb754d5bf8897acfeb9762031fbe00d197c45aed84f2fe069dcd78109a1
98c1d9168df53dd9c2da28bfafb7af7a417719ab2fed404a3bacc7aeea3d5872
5d81fbfb555468e8dbcaf4eb11db5eb50a0bef70df7e8322a84fac5d6cb88977
1957dd6825a26dea37818afdad0143a9b12c2c2ec68ed0058d89b15d55c762f1
SH256 hash:
25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557
MD5 hash:
c97c519b7b00a60d9dd9f8ced68c5c2b
SHA1 hash:
9bbd320ae5901ba787cb5ecef1d71bef332d3e66
Link:
https://www.unpac.me/results/f3689494-4555-4669-b139-c8e0ba9136b0/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/25c4ee082387/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MALWARE_Win_A310Logger
Create hunting rule
Author:ditekSHen
Description:Detects A310Logger
Rule name:MALWARE_Win_StormKitty
Create hunting rule
Author:ditekSHen
Description:Detects StormKitty infostealer
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_1_RID2B54
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:win_masslogger_w0
Create hunting rule
Author:govcert_ch

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

tar 101b3cc3a483b862054173d2c367eb0bcfb072e28687a7aa52914a43fb28aed4

QuasarRAT

Executable exe 25c4ee0823873ad0e9fed128dcfb45ebb821fe7a17c396026b8d8be1c2400557

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 101b3cc3a483b862054173d2c367eb0bcfb072e28687a7aa52914a43fb28aed4
Cape
Cape
https://www.capesandbox.com/analysis/315739/
  
Dropped by
MD5 b87f4c8fdc90163fa31d01937ef851d0

Comments