MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba
SHA3-384 hash: b4cbcfc7f292a10a13eaa8fcb5cecaf8973de2aa77620ede60ac4d201b433d1ea29a55685ac01ff1631a0302a79fbae9
SHA1 hash: 60af71fb691b4ab299526a26637f823f7ced3450
MD5 hash: 37bebc90630b20c8d9142cfde16c568c
humanhash: uranus-one-georgia-william
File name:409000005400.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:362'258 bytes
First seen:2021-07-13 06:13:20 UTC
Last seen:2021-07-13 06:43:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 6144:1qjIm/5yRCaqYTbXQwNsKvY++KHs5Wvkl+Nox8YiV:8lyAaqYTTQwNPvPBHNBmx8YiV
Threatray 4'805 similar samples on MalwareBazaar
TLSH T1F774BF21F600D6E6ED6557B168FA8832076BBC3CD8741A1F65C9326566F3392009FE8F
Reporter lowmal3
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
409000005400.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 06:16:05 UTC
Tags:
evasion stealer
Link:
https://app.any.run/tasks/87156609-e740-4087-8dce-752b2b26de81

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
StormKitty
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171248/
Detection(s):
SecuriteInfo.com.Zum.Androm.1.2841.7307.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
a310logger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/83c0e646-241c-45cd-89ad-06b2d09eb9f8
Result
Threat name:
SpyEx StormKitty a310Logger
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815300
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected a310Logger
Yara detected SpyEx stealer
Yara detected StormKitty Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447711 Sample: 409000005400.exe Startdate: 13/07/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 5 other signatures 2->59 8 409000005400.exe 17 2->8         started        process3 file4 33 C:\Users\user\AppData\Local\Temp\lwuqx.dll, PE32 8->33 dropped 67 Detected unpacking (changes PE section rights) 8->67 69 Detected unpacking (overwrites its own PE header) 8->69 71 Maps a DLL or memory area into another process 8->71 12 409000005400.exe 1 3 8->12         started        signatures5 process6 signatures7 73 Writes to foreign memory regions 12->73 75 Allocates memory in foreign processes 12->75 77 Sample uses process hollowing technique 12->77 79 2 other signatures 12->79 15 InstallUtil.exe 15 7 12->15         started        19 InstallUtil.exe 6 12->19         started        22 InstallUtil.exe 12->22         started        process8 dnsIp9 35 24.107.12.0.in-addr.arpa 15->35 37 icanhazip.com 104.18.7.156, 49734, 49773, 80 CLOUDFLARENETUS United States 15->37 39 api.mylnikov.org 172.67.160.130, 443, 49735, 49774 CLOUDFLARENETUS United States 15->39 43 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->43 45 May check the online IP address of the machine 15->45 47 Tries to steal Instant Messenger accounts or passwords 15->47 24 MZ.exe 3 15->24         started        41 24.107.12.0.in-addr.arpa 19->41 31 C:\Users\user\AppData\Roaming\...\MZ.exe, PE32 19->31 dropped 49 Tries to steal Mail credentials (via file access) 19->49 51 Tries to harvest and steal browser information (history, passwords, etc) 19->51 27 MZ.exe 2 19->27         started        29 WerFault.exe 22->29         started        file10 signatures11 process12 signatures13 61 Antivirus detection for dropped file 24->61 63 Multi AV Scanner detection for dropped file 24->63 65 Machine Learning detection for dropped file 24->65
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 06:14:07 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivkroae737mhpcp573bdzsy3acwil5ntxtchimhuoco5vnahh65a._file
Verdict:
malicious
Similar samples:
041e611b0ba792d4d87d0be0a36bbc90448598e84b40f669b8fef3acdfee0eee
QuasarRAT
0de23ae1b8456d391ce231190ced1e799a5dccf4b6ec28206aca2f77ba18da11
QuasarRAT
11db354a5d6b15b2aad9747f275e846283c9024a434d2f288e95abfd3ec7dfd7
QuasarRAT
3ee1aeeacc6fd3c792af90f2bf0faba3eb71fc8aad0a9e9b1950f75561eed3eb
QuasarRAT
56855ec2eaecac2dc657e738098edcf0146b6a82bd84a5205b7f85072264c38e
QuasarRAT
77d69fc2f79de7f28dfe67e4cb6b7fa1e994a2a16831fd918d3dca53a523f2c1
QuasarRAT
7db01b21b6b4c6e977c8f96e204495b11d566c780c51198198195ec7045c7dce
QuasarRAT
ae66143bb6965a7f1122c8eb776085ce679d038b8dd886f954ecd5e45aff4664
QuasarRAT
bb4bee5b46aecada1017a93042b3b0fc926f75e8230d4de29f204c9234c98220
QuasarRAT
d5d6dcf7e05158c3d2abc10588ab6ca17cb2d4082720d8847b28894cafc0ead6
QuasarRAT
+ 4'795 additional samples on MalwareBazaar
Result
Malware family:
stormkitty
Create hunting rule
Score:
  10/10
Tags:
family:a310logger family:stormkitty spyware stealer
Link:
https://tria.ge/reports/210713-jmjy2l2c3a/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Looks up geolocation information via web service
Loads dropped DLL
Reads local data of messenger clients
Reads user/profile data of web browsers
Executes dropped EXE
A310logger Executable
A310logger
StormKitty
StormKitty Payload
Unpacked files
SH256 hash:
218073bda7a00e780704c1289d5e22ad27bb3ba11f210afa18af33a6ad5176e9
MD5 hash:
1bad0cbd09b05a21157d8255dc801778
SHA1 hash:
ff284bba12f011b72e20d4c9537d6c455cdbf228
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
SH256 hash:
61560f470822a249950e3d35574aae0ee9c93da31c1fd6f001c0cec97069a4fb
MD5 hash:
b3d0b8c065ad75dfd646829bc7c87735
SHA1 hash:
629655f03b356ad46ae106855eb004c7be7098c0
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
SH256 hash:
b9dcf75696ba71f292246a31877cc8c833676c5c8c241e65c741711388d99bcb
MD5 hash:
07ddb19024ba308280048375e9be32ff
SHA1 hash:
e2714ca01a6e8e8713e9e2a175c0e3598ebb75df
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
SH256 hash:
119d324456593d719625194a2a950f3bc126f9b42d84ae5f4dfd8cb283e76928
MD5 hash:
acd6a8e0415589a5a9fecc4cf18eb79c
SHA1 hash:
37f5a2f47e1208be52e1cdff79001b3b48741793
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
SH256 hash:
61725da1e31839c51a3fa204df0cc3ec2739db3ae9f6f7738efe06d2f8a6e9f8
MD5 hash:
b040240887dd41d3e013a70dbbe736cd
SHA1 hash:
e309f4ee151e6da77b3adedbd2e65c89ebfc1572
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
SH256 hash:
455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba
MD5 hash:
37bebc90630b20c8d9142cfde16c568c
SHA1 hash:
60af71fb691b4ab299526a26637f823f7ced3450
Link:
https://www.unpac.me/results/5da95409-e9d8-4b50-9fec-124272d2984b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_StormKitty
Create hunting rule
Author:ditekSHen
Description:Detects StormKitty infostealer
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

Executable exe 455517009fdfd87789fdfec23ccb1b00ac85f5b3bcc47430f4709ddab4073fba

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/171248/

Comments