MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915
SHA3-384 hash: d40d0bf5666160a28e31229fb37823e5b7380598c806928b149b8564169630d9b3bd4a5e9c7c1aefd11228b733a197d7
SHA1 hash: 33c77f6b12a89171f91a212b233a43d4dfd9be71
MD5 hash: 1ebc16b09f9f1cdf224a0b50333c95ae
humanhash: six-eighteen-lamp-mockingbird
File name:1ebc16b09f9f1cdf224a0b50333c95ae.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:884'218 bytes
First seen:2024-06-12 03:00:35 UTC
Last seen:2024-06-12 03:21:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:EgxwPTQBSqsfmrrPccQejxv6LP9V/Z+jqV1JudejYmKD4/h9lDS0SqEVVEbNoi11:VxFeqPNFycCMdeqD4ZDpSfVaCqDnh
Threatray 360 similar samples on MalwareBazaar
TLSH T115152345EE124E3FE97B2B384D055AA21768B0C6EB11C78D2B0D7325785BA7F345A3C2
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:exe QuasarRAT RAT


Avatar
abuse_ch
QuasarRAT C2:
38.180.9.93:4782

Intelligence

File Origin
# of uploads :
2
# of downloads :
430
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915.exe
Verdict:
Malicious activity
Analysis date:
2024-06-12 03:03:53 UTC
Tags:
rat asyncrat remote quasar evasion
Link:
https://app.any.run/tasks/1a9dfd85-7309-4a53-968d-22b9426bcaf5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.73.6123.23833.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66691023530d67a8336279f8win7simulatehigh_evasion
Tags:
Banker Encryption Execution Generic Network Stealth Quasar Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Connection attempt
Sending a custom TCP request
DNS request
Blocking the User Account Control
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed quasar quasarrat
Link:
https://www.filescan.io/uploads/66690f6fce78046c1aada194/reports/4c9b5132-ff89-464b-8aeb-858c64a24b9a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40721e0d-458b-4f94-b4d6-d0b06e3f98b4
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1455739
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Disables UAC (registry)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Silenttrinity Stager Msbuild Activity
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Quasar RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1455739 Sample: e03WpAyb8R.exe Startdate: 12/06/2024 Architecture: WINDOWS Score: 100 37 tools.keycdn.com 2->37 39 api.ipify.org 2->39 47 Snort IDS alert for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 11 other signatures 2->53 9 e03WpAyb8R.exe 1 3 2->9         started        12 MSBuild.exe 2->12         started        signatures3 process4 signatures5 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->55 57 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->57 59 Writes to foreign memory regions 9->59 61 3 other signatures 9->61 14 MSBuild.exe 14 8 9->14         started        18 powershell.exe 23 9->18         started        20 WerFault.exe 19 16 9->20         started        25 2 other processes 9->25 23 conhost.exe 12->23         started        process6 dnsIp7 41 tools.keycdn.com 185.172.148.96, 443, 49713 PROINITYPROINITYDE Germany 14->41 43 38.180.9.93, 4782, 49707 COGENT-174US United States 14->43 45 api.ipify.org 172.67.74.152, 443, 49714 CLOUDFLARENETUS United States 14->45 63 Uses schtasks.exe or at.exe to add and modify task schedules 14->63 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->65 27 schtasks.exe 1 14->27         started        67 Loading BitLocker PowerShell Module 18->67 29 WmiPrvSE.exe 18->29         started        31 conhost.exe 18->31         started        35 C:\ProgramData\Microsoft\...\Report.wer, Unicode 20->35 dropped file8 signatures9 process10 process11 33 conhost.exe 27->33         started       
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915
Detection:
quasar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915/
Threat name:
ByteCode-MSIL.Backdoor.QuasarRAT
Create hunting rule
Status:
Malicious
First seen:
2024-06-08 05:28:00 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzpca4yyke772ztfhjiqnijb2j4qvgg4ewqqhrt4gr3lcqtbfekq._file
Verdict:
malicious
Similar samples:
1416bd55b04a4d8299c3e976e4e6a160850471e330d25f332f70d8ca618de894
QuasarRAT
37fa30c9dcf255bda62c0a6b7f88a48263a3da18d18d8c66b1cbbc801077cfdf
QuasarRAT
4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915
QuasarRAT
a24dafb52de61a6bb3d363afb0d02ac3311d4a4f221b20f246c2fa2d5cb352fd
QuasarRAT
f49f187849de1ec6c2ac50585cc3ce47ff4b220e413cdedb63b762efd4504bcd
QuasarRAT
+ 350 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:office04 evasion execution spyware trojan
Link:
https://tria.ge/reports/240612-dhwd9szarn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Windows security modification
Command and Scripting Interpreter: PowerShell
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Quasar RAT
Quasar payload
UAC bypass
Windows security bypass
Malware Config
C2 Extraction:
38.180.9.93:4782
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/49c0774c-0fff-4df0-bf2e-26b7313b0938
Unpacked files
SH256 hash:
4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915
MD5 hash:
1ebc16b09f9f1cdf224a0b50333c95ae
SHA1 hash:
33c77f6b12a89171f91a212b233a43d4dfd9be71
Link:
https://www.unpac.me/results/7aa7982d-7e4d-4424-bbd7-067488c8cf34/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4e5e20731851/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4e5e207318513ffd66653a5106a121d2790a98dc25a103c67c3476b142612915

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:MALWARE_Win_QuasarStealer
Create hunting rule
Author:ditekshen
Description:Detects Quasar infostealer
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:quasarrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vermin_Keylogger_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Vermin Keylogger
Reference:https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments