MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f4f87b7f22385d5877154cb66780170f19ba39fe17e90b6ddd1581e0cf26bd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f4f87b7f22385d5877154cb66780170f19ba39fe17e90b6ddd1581e0cf26bd2
SHA3-384 hash: 0f1dbe0dd7762a453350d45eb34c47dcbfff48be8cbf3ad66d0975c5676f471bbabd816e08948761875a30b32e332e38
SHA1 hash: dd136a91b7ce95a8d76779a33f96784960842b25
MD5 hash: 8e9331615105320c8012868a644b31c5
humanhash: pluto-apart-violet-august
File name:SF24.ISO
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:53'248 bytes
First seen:2021-01-12 07:20:27 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24:57TyneCxTvgAX1AQrkKS9pFct7nSTOt03AAIVllludveVemVB:57TynPxTvgAF7iFcJKxdvyrV
TLSH 2433483B5E415034C469D2318CB5B96D6A67B0C922F7A60FF55DC5E82B8FEC84A22392
Reporter abuse_ch
Tags:iso QuasarRAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: mout.perfora.net
Sending IP: 74.208.4.197
From: TechBill#67549524625 <BillGlobal-id6754952@domain.com>
Subject: your order has been placed##675495
Attachment: SF24.ISO (contains "SF24.vbs")

QuasarRAT payload URL:
https://z.zz.ht/nlOiE.jpg

Intelligence

File Origin
# of uploads :
1
# of downloads :
406
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ISB.Downloadergen48.23419.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f4f87b7f22385d5877154cb66780170f19ba39fe17e90b6ddd1581e0cf26bd2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-12 07:21:08 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5hypn7seoc5lb3rktfwm6abodyzxi474f7jbnw52fmb4dhsnpja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4f4f87b7f22385d5877154cb66780170f19ba39fe17e90b6ddd1581e0cf26bd2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

iso 4f4f87b7f22385d5877154cb66780170f19ba39fe17e90b6ddd1581e0cf26bd2

(this sample)

QuasarRAT

Visual Basic Script (vbs) vbs 8e9a3943e6d8e8409b427e7ad9f60e43164d8ea99ae2755df7804013508c15a2

  
URLhaus
https://urlhaus.abuse.ch/url/954554/
  
Dropping
MD5 7087da8128aa173da193dd4b8432ed71
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e9a3943e6d8e8409b427e7ad9f60e43164d8ea99ae2755df7804013508c15a2

Comments