MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a
SHA3-384 hash: f9a8a09b147b3b21079ee0cd878243a19944341444f14c9f7005a702e74b5a6ee1e38206d09387cb94f597e74a2cf8af
SHA1 hash: f139ecaf4fa8cfd331e0a0d44588ad3a39829bde
MD5 hash: 348ca0ab6fc760bf54e874c45c254240
humanhash: whiskey-charlie-spring-south
File name:2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:356'864 bytes
First seen:2020-11-15 23:06:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'854 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 6144:ETIDkAT6QSkszJqdcl6A4so1IbnADbAI1nrukWUAuk6EmyJSwi:O6iksNlf4D1JDsIRrIUAuk6EUwi
TLSH 9C745A1377E4EA3BD1FD173AA43206156BB0D446B716E38B6A6855FC6C123868E807F3
Reporter seifreed
Tags:QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-6295765-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Win.Packed.Passwordstealera-9792228-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Creating a file in the Windows subdirectories
Launching a process
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a file
Setting a keyboard event handler
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Creating a window
Running batch commands
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/537446
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 317819 Sample: wQDprpZ6i7 Startdate: 16/11/2020 Architecture: WINDOWS Score: 100 69 Malicious sample detected (through community Yara rule) 2->69 71 Antivirus detection for dropped file 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 9 other signatures 2->75 10 wQDprpZ6i7.exe 15 5 2->10         started        15 wQDprpZ6i7.exe 2 2->15         started        process3 dnsIp4 67 ip-api.com 208.95.112.1, 49709, 49714, 49726 TUT-ASUS United States 10->67 59 C:\Windows\...\Realtek audio drivers.exe, PE32 10->59 dropped 61 C:\Users\user\AppData\...\wQDprpZ6i7.exe.log, ASCII 10->61 dropped 91 Hides that the sample has been downloaded from the Internet (zone.identifier) 10->91 17 Realtek audio drivers.exe 14 6 10->17         started        21 schtasks.exe 1 10->21         started        file5 signatures6 process7 dnsIp8 63 ip-api.com 17->63 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->77 79 Installs a global keyboard hook 17->79 23 cmd.exe 1 17->23         started        26 schtasks.exe 1 17->26         started        28 WerFault.exe 23 9 17->28         started        30 conhost.exe 21->30         started        32 conhost.exe 21->32         started        34 chcp.com 21->34         started        36 2 other processes 21->36 signatures9 process10 signatures11 85 Uses ping.exe to sleep 23->85 38 Realtek audio drivers.exe 4 23->38         started        42 conhost.exe 23->42         started        44 PING.EXE 1 23->44         started        46 chcp.com 1 23->46         started        48 conhost.exe 26->48         started        process12 dnsIp13 65 ip-api.com 38->65 87 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->87 89 Installs a global keyboard hook 38->89 50 cmd.exe 38->50         started        53 schtasks.exe 38->53         started        55 WerFault.exe 38->55         started        signatures14 process15 signatures16 81 Uses ping.exe to sleep 50->81 83 Drops executables to the windows directory (C:\Windows) and starts them 50->83 57 conhost.exe 53->57         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a/
Threat name:
ByteCode-MSIL.Backdoor.QuasarRAT
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 23:09:27 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7ku6yrokpq3qaxnal63g7bm2ydqhyntkkiv2gudc77frqhqk6na._file
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar spyware trojan
Link:
https://tria.ge/reports/201115-lle9k41pej/
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in System32 directory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
ServiceHost packer
Quasar RAT
Unpacked files
SH256 hash:
2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a
MD5 hash:
348ca0ab6fc760bf54e874c45c254240
SHA1 hash:
f139ecaf4fa8cfd331e0a0d44588ad3a39829bde
Link:
https://www.unpac.me/results/c429cee9-690a-467b-ade7-9bb1af70625f/
SH256 hash:
a4496e05810136852316b46d609e30e68179119916c73a6112e8b68ba6f03a2b
MD5 hash:
c773372d418e18a4380ac50ae38a0078
SHA1 hash:
7bb92be8d8b3e5eaf871519065edfb0b42f49425
Link:
https://www.unpac.me/results/c429cee9-690a-467b-ade7-9bb1af70625f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2fd54f622e53e1b802ed02fdb37c2cd60703e1b352915d1a8317fe58c0f0579a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:CN_disclosed_20180208_KeyLogger_1
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MSILStealer
Create hunting rule
Author:https://github.com/hwvs
Description:Detects strings from C#/VB Stealers and QuasarRat
Reference:https://github.com/quasar/QuasarRAT
Rule name:Quasar
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Vermin_Keylogger_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Vermin Keylogger
Reference:https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
Rule name:xRAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments