MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e2d9c77f71c4cb605adb49ee932ad9a07e53f931d7845c6731f1a75c5a57cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 8 File information Comments

SHA256 hash:	46e2d9c77f71c4cb605adb49ee932ad9a07e53f931d7845c6731f1a75c5a57cd
SHA3-384 hash:	f3edd2845b75443dbe06dbe5c43a92fdfc956cc99b1506cfbfd2ec6a3c2d2f65677cb87ec7cb1281b94732148a35fecc
SHA1 hash:	648f97c9cae6169a49cbad0eaaad6c69162b4e52
MD5 hash:	a8e3bace30ecc0f82c68f12282d7e487
humanhash:	robin-chicken-florida-nineteen
File name:	a8e3bace30ecc0f82c68f12282d7e487.exe
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	514'048 bytes
First seen:	2022-08-02 17:40:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:MTEgdc0YfXAGbgiIN2RSBfTC68iepFPVx7Y8cEXUOb8F9LWDOOj4Mp9fA/kcTR36:MTEgdfY3bgUpvxE8nUp9WDOOjB9fcd6
Threatray	2'043 similar samples on MalwareBazaar
TLSH	T112B46C4023F8862BE1AF9779EC710A2067F5E407B267EB8F5540B1F92D667069E80773
TrID	53.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 12.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.6% (.SCR) Windows screen saver (13101/52/3) 7.7% (.EXE) Win64 Executable (generic) (10523/12/4) 4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter	abuse_ch
Tags:	exe QuasarRAT RAT

abuse_ch

QuasarRAT C2:
109.206.241.81:4782

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
109.206.241.81:4782	https://threatfox.abuse.ch/ioc/841151/

Intelligence

File Origin

# of uploads :

# of downloads :

320

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

quasar

ID:

File name:

a8e3bace30ecc0f82c68f12282d7e487.exe

Verdict:

Malicious activity

Analysis date:

2022-08-03 06:33:31 UTC

Tags:

trojan rat quasar asyncrat

Link:

https://app.any.run/tasks/db059243-a240-41ba-8c5a-d95147462ac3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

QuasarStealer

Link:

https://www.capesandbox.com/analysis/295954/

Detection(s):

Win.Malware.Bulz-9823462-0

Win.Malware.Generic-9883082-0

Win.Malware.Generic-9883083-0

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Win.Packed.Downeks-6898097-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Setting a keyboard event handler

Sending a custom TCP request

DNS request

Using the Windows Management Instrumentation requests

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm greyware keylogger packed quasarrat rat shell32.dll stealer vermin

Link:

https://www.filescan.io/uploads/62e961eb6336465f2a06a19c/reports/3215f744-b0ee-44b2-bfdf-b8cc72305b91/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fb30c57c-0311-4876-91a6-a4650a598926

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1045078

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Snort IDS alert for network traffic

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

quasar

Link:

https://mwdb.cert.pl/sample/46e2d9c77f71c4cb605adb49ee932ad9a07e53f931d7845c6731f1a75c5a57cd/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2022-08-02 17:41:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 25 (96.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i3rntr37ohcmwyc23ne65ezk3gqh4u7zghlyixdhghy2oxc2k7gq._file

Verdict:

malicious

QuasarRAT

585e4146923404bbe11c2cf5a423e2650a5d133541e9baeacb64a4d675f6484d

QuasarRAT

66aa3076bab656dc495c3a7cd2f8cfef86ffe2082d209fabe8c64905b8c76cb9

QuasarRAT

71b507a5d2ef28b951d65ba5a737c75e6e0ecdda454e7c70a40bd37b083ce9bd

QuasarRAT

7d6cfc5cfb6243152ee28b41a00650c3c95cc3615a5407c6ec094632926b99e2

QuasarRAT

8be3c7231a1d547531c3e669d380fd00b5b3e773da201b34bed04810062329c0

QuasarRAT

a792be03af23fe52b708d22df6cadeb3374bb5500416a862eee57ea56db20fd5

QuasarRAT

d3a5310046716a79439b26f59b1cd70e4220fbb3d4161c8cd57806be2b56be43

QuasarRAT

ea04e1c9f1de856c0a0023309410a758b26bdff39e4afbfe329a9b6a805cf23e

QuasarRAT

+ 2'033 additional samples on MalwareBazaar

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:office04 spyware trojan

Link:

https://tria.ge/reports/220802-v9ez2aaffk/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

109.206.241.81:4782

Unpacked files

SH256 hash:

46e2d9c77f71c4cb605adb49ee932ad9a07e53f931d7845c6731f1a75c5a57cd

MD5 hash:

a8e3bace30ecc0f82c68f12282d7e487

SHA1 hash:

648f97c9cae6169a49cbad0eaaad6c69162b4e52

Link:

https://www.unpac.me/results/362a2f4b-9d7f-46e7-8afa-24b64a2ce849/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/46e2d9c77f71c4cb605adb49ee932ad9a07e53f931d7845c6731f1a75c5a57cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	MALWARE_Win_QuasarStealer Create hunting rule
Author:	ditekshen
Description:	Detects Quasar infostealer

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MAL_QuasarRAT_May19_1_RID2E1E Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/