MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b8557286deebc72d82c7b0780cc2b115b82a042d906c0c619415bc906e3b56d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 8 File information Comments

SHA256 hash:	5b8557286deebc72d82c7b0780cc2b115b82a042d906c0c619415bc906e3b56d
SHA3-384 hash:	882f308e889adabc9f085c1607cac27d2d7d33f3c310e76521fea00bc7eceb523dd5689ddc8a8604b7bb31e360b309b9
SHA1 hash:	f45a3196cfae8d908d71e3c9ab5d9aaeea13695b
MD5 hash:	38d061d2e6e25c588c5008338631d25c
humanhash:	vermont-zebra-twelve-winter
File name:	SecuriteInfo.com.BackDoor.QuasarNET.1.21320.7567
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	244'224 bytes
First seen:	2020-09-03 00:57:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	3072:M7H+i3JS8dq89TEtSnH5I3ilm+Jb7rwi86BAIiGl9rwHsqFxLrQwbG+rVv:M7H6+TmSZ/mqrwiHd9SdrL
TLSH	7D342A1A33E88F5AEAEF477AD43045008778F917EA1BD3DE4FE094A52D23310DA457A6
Reporter	SecuriteInfoCom
Tags:	QuasarRAT

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QuasarRAT

Link:

https://www.capesandbox.com/analysis/54571/

Detection(s):

SecuriteInfo.com.BackDoor.QuasarNET.1.21320.7567.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Using the Windows Management Instrumentation requests

DNS request

Sending an HTTP GET request

Connection attempt

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/457958

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Antivirus / Scanner detection for submitted sample

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Uses dynamic DNS services

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b8557286deebc72d82c7b0780cc2b115b82a042d906c0c619415bc906e3b56d/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2016-07-08 08:24:00 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=locvokdn526hfwbmpmdybtblcfnyficc3edmbrqzifn4sbxdwvwq._file

Verdict:

unknown

Result

Malware family:

quasar

Score:

10/10

Tags:

trojan spyware family:quasar

Link:

https://tria.ge/reports/200903-vzvfnzwf7n/

Behaviour

Suspicious use of AdjustPrivilegeToken

Looks up external IP address via web service

Quasar RAT

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Quasar

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5b8557286deebc72d82c7b0780cc2b115b82a042d906c0c619415bc906e3b56d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	CN_disclosed_20180208_KeyLogger_1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	MSILStealer Create hunting rule
Author:	https://github.com/hwvs
Description:	Detects strings from C#/VB Stealers and QuasarRat
Reference:	https://github.com/quasar/QuasarRAT

Rule name:	Quasar Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect QuasarRAT in memory

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/