MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c525f83e1414e33353169d89e84a5e22857c55727a30aa1c78fc1ccfb83900f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c525f83e1414e33353169d89e84a5e22857c55727a30aa1c78fc1ccfb83900f
SHA3-384 hash: 4627e5c7aa177f56c9d7dc5507508031578794d9bae6f23700e205a7b628f671817788fbebc0fb1a2ee44937a40834fb
SHA1 hash: 8a733f27e1c5d554acd8d6d6ebbeb8245be05308
MD5 hash: 7fc27dd9121558a8ab0d3f5afe75c4a5
humanhash: avocado-uranus-seven-ohio
File name:SFiQVVTj.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:553'984 bytes
First seen:2020-03-17 14:45:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:Q7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbkW5yh:ulJtTF9zVGkllbkW4
Threatray 78 similar samples on MalwareBazaar
TLSH DEC4392537A4A53BF5ED0374E5F4A1184BB6FC067416E38E2958FAE828373C486427E7
Reporter johannes
Tags:QuasarRAT


Avatar
viql
quasarrat via https://pastebin.com/raw/SFiQVVTj

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Barys-1
Create hunting rule

Win.Trojan.Generic-6295765-0
Create hunting rule

Win.Ransomware.Generic-6545091-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Win.Trojan.Generic-6898101-0
Create hunting rule

Win.Trojan.Generic-6898102-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Tinclex
Create hunting rule
Status:
Malicious
First seen:
2020-03-18 12:58:10 UTC
AV detection:
31 of 45 (68.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrjf7a7bifhdgnjrnhmj5bff4iufprkxe6rqviohr7a4z64dsahq._file
Verdict:
malicious
Similar samples:
04a908a9e407549cb834e945f0afb49da90f7581bda7e2d2cd3871a55997d53b
QuasarRAT
1a3bf054f01ab4ec1c068ee4bbb5961a3109e61a12374c26501ce7a772279463
QuasarRAT
33eff9415626bfe8ec4229ef6a6b248e0e6b7b1115c84a78724dd9b58336bb28
QuasarRAT
3c7744b3236b34b32adf0b3a3d5b7874533878c34d200d2c07fe0e0e37cb16f6
QuasarRAT
3e5bbf9fcae918011ec4eee75ac6402fddf20d09fef95b362d0e226d56b80f1d
QuasarRAT
57372f78f979ab331a3ce1ebd9154c6eb4674db4de60c5c6b521934d7b9463ac
QuasarRAT
69bc65bef9fd7833c261434e1feb538861fc3359b66bde16a8cc0e8375a7b92c
QuasarRAT
7d6e222b4b23f7d10f667027b0de0c51ea5262a415880c90fe60a3596a27a40d
QuasarRAT
a4fcf02ada330a1e50982618833ae730d5238adbf9407e303cc6c05fa8270ba5
QuasarRAT
a7e7de656010612d8f5741491c7f5e4480d8face10c5f1c445fdfda6d70b4908
QuasarRAT
+ 68 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c525f83e1414e33353169d89e84a5e22857c55727a30aa1c78fc1ccfb83900f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/SFiQVVTj

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments