MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 32 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
SHA3-384 hash: de39c25c2e6fe4bfbbf620df1290ce8f7bf8e79efc1cd95a8cd48acc0f2a0c1f48447e408b2d969a1554ac7f6af6effe
SHA1 hash: 22be6ebee5de1cde10fd53e99c27a4a82957fdaf
MD5 hash: c12f6e9895f52bd70c8411d7f26e1d6d
humanhash: kansas-paris-leopard-blossom
File name:17273903480db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f534.dat-decoded
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'085'952 bytes
First seen:2024-09-26 22:39:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:Naynkc1ZzBvtrZHFjMKY20P7celYz1qiJvzOB:kynkc1ZzBvtrZHFjMKY2Cceli0iJvz
Threatray 89 similar samples on MalwareBazaar
TLSH T18B352914F7E855A5F06E7F72B47158054B38FE036A3DD74B2B9690981A2A380DCB2F63
TrID 40.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
31.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
9.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.7% (.EXE) Win64 Executable (generic) (10523/12/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika pebin
Reporter abuse_ch
Tags:base64-decoded exe QuasarRAT


Avatar
abuse_ch
Malware dropped as base64 encoded payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
599
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
17273903480db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f534.dat-decoded
Verdict:
Malicious activity
Analysis date:
2024-09-26 22:42:11 UTC
Tags:
evasion rat quasar remote crypto-regex
Link:
https://app.any.run/tasks/f9ac66a5-b8d8-4e6c-8b31-eaee059e5f83

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Ursu-9802322-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f5e2c579032805ce8e3f87
Tags:
Discovery Generic Network Stealth Autorun Quasar
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm anti-vm certutil cmd cmstp evasive evasive eventvwr explorer fingerprint fingerprint fingerprint hook keylogger lolbin lolbin macros-on-open net netsh packed powershell quasarrat rat reg regasm regedit remote schtasks stealer update vbnet
Link:
https://www.filescan.io/uploads/66f5e2c319fd255708d75f77/reports/2ea17b01-81df-4874-9408-50a0c3254e82/overview
Verdict:
Malicious
Labled as:
Trojan.Agent
Link:
https://www.hybrid-analysis.com/sample/326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bff8b0a9-cf1c-482c-88c3-75b26ec86ac6
Result
Threat name:
Clipboard Hijacker, Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1519800
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Contains functionality to disable the Task Manager (.Net Source)
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Potentially Suspicious Malware Callback Communication
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected Quasar RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2024-09-26 22:40:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
32 of 38 (84.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjxakgg2wgd4e6dp7mkctjy5y5so7arbdkxvtpgtvctyyakxskbq._file
Verdict:
malicious
Label(s):
venomrat
Create hunting rule
Similar samples:
0e01c7577cb631dc13248dcc5da5fedc957747244a1ed10783027431ac1731b7
QuasarRAT
11dbce37dfbc51c96c4f699c51e3c1bb7626cb7efcdbb9408cc500428a48827e
QuasarRAT
547679ede9037e0edceeaa3e10b5f9ba6b8af47e6a3fa38b825c769005f182ef
QuasarRAT
83006c24730b2d7fb7506451aee3d6bb85cc27d64e230630bc66517c7ba9ed21
QuasarRAT
98ed685e58c13887c499cef7806acfd58d771bdcf95b60d8c7604fd500a466ba
QuasarRAT
d79a203caba18b6e1190b0022296d56f96253d4fb39b96aaaeaaa02241f28b16
QuasarRAT
e89780d28b646c9d08262ce5e98461ccad3bf797848556c711f18de2b4c2b058
QuasarRAT
+ 79 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:hotels discovery spyware trojan
Link:
https://tria.ge/reports/240926-2lhvca1gpk/
Behaviour
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Looks up external IP address via web service
Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
23.227.193.34:5552
Verdict:
Malicious
Tags:
red_team_tool downloader rat quasar_rat trojan
YARA:
RDPWrap MALWARE_Win_DLAgent10 malware_windows_quasarrat malware_Quasar_strings MALWARE_Win_QuasarRAT JPCERTCC_Quasar MAL_QuasarRAT_May19_1 MAL_NET_LimeCrypter_RunPE_Jan24
Link:
https://app.threat.zone/submission/c88925c9-c8d5-4d0b-9f69-1e95ce5dc098
Unpacked files
SH256 hash:
542be6a092437c47aec4c046bf4636f9a3153954b0384141b8cc2922d68a38b5
MD5 hash:
bfb7da75069724d5ec80b44bc2e46d9f
SHA1 hash:
fe757e6a079f7be6efa5d15df7260792560f6576
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
SH256 hash:
866c468f227e0ee2c3614cf97e74ebacf79fecb24845210488d13a42824cf50d
MD5 hash:
b064ffbd0835d50b00ebe34660832ecf
SHA1 hash:
bf5b5bba369127ccc6d740f27e40b2c67b5cf8bd
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
SH256 hash:
3db2b0c012e3e770548b36eb84ea2278f34dfda82a269fc30f38e743b33855e3
MD5 hash:
ef33c4c8efc8c1b355ad64e12b010070
SHA1 hash:
ac30158d8bd81ec0b728a299c9e72789b4f33f31
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
SH256 hash:
3a96d9a797a3b6b3ea0d8264ed1078508df9557e2f453217d52a75907f9b9465
MD5 hash:
547ebc92cac936d8c3459d2765948f4a
SHA1 hash:
09c143d609b65b19a97289ca7645df2a0bc39c83
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
SH256 hash:
c1428ec7129ad3e36dad35d8992602cefcd6a593952834897424314fe029dd4b
MD5 hash:
67ca4c5eed9cab4b08064d4314dc0a86
SHA1 hash:
61dfa1d80d9e6b506d29e3897dd3ca08ade30988
Detections:
INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
Parent samples :
a53a585de940ceb15a7b30f6d6157b0e9722d7b81cea4a2dadb1f0c7410fae87
e2cc914a1df535f2cf88007a518a9990afe5ccdb9cf1262e550e2ce8cc9c7eb0
fbe788dd0db451b33c60b855c9aa18af0d2b87140cfa25a0a78be290d10089cc
ace5504608d43d701becbb246abe3c7b0483fd3904c13a5677084e6f98ef0271
d4e3e9ccf34249744cc8bbeba02fb11626604b8093edc8d85326b467e6aeb7b1
326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
2a8c219afd3d9e171dc1515b32185bad9172bbcdaf15a6a7502458b6e7553ff5
8c5659ff1e439fdb199c25ac76fb8d3e9c45b702ac8c99073ccdf7fd1f9cdbfd
SH256 hash:
326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
MD5 hash:
c12f6e9895f52bd70c8411d7f26e1d6d
SHA1 hash:
22be6ebee5de1cde10fd53e99c27a4a82957fdaf
Detections:
RDPWrap
Create hunting rule
QuasarRAT
Create hunting rule
malware_windows_xrat_quasarrat
Create hunting rule
RDPWrap
Create hunting rule
SUSP_NET_Msil_Suspicious_Use_StrReverse
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
MAL_NET_LimeCrypter_RunPE_Jan24
Create hunting rule
Quasar
Create hunting rule
MAL_QuasarRAT_May19_1
Create hunting rule
Link:
https://www.unpac.me/results/5cb64dba-5e72-4f26-9743-1b880c983c7b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination indicative of disabling Windows Defender features
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding command execution via IExecuteCommand COM object
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
Create hunting rule
Author:ditekSHen
Description:detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Rule name:malware_Quasar_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:MALWARE_Win_DLAgent09
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:MALWARE_Win_DLAgent10
Create hunting rule
Author:ditekSHen
Description:Detects known downloader agent
Rule name:MALWARE_Win_QuasarRAT
Create hunting rule
Author:ditekSHen
Description:QuasarRAT payload
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Description:Detects QuasarRAT malware
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_NET_Msil_Suspicious_Use_StrReverse
Create hunting rule
Author:dr4k0nia, modified by Florian Roth
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Reference:https://github.com/dr4k0nia/yara-rules
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

0db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f

QuasarRAT

Executable exe 326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283

(this sample)

  
Dropped by
SHA256 0db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f
  
Dropped by
MD5 6467b2c2019db62a4a06ac13ae4c9ba9
  
URLhaus
https://urlhaus.abuse.ch/url/3124408/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments