MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037
SHA3-384 hash: b0aba7a922305685c915a26aee860e55deae36a46deabb0a3fe7e826b1198dfde8f0c5816aa1db0b2d20bb64a7a72c38
SHA1 hash: 075fde29315b4e205e7c73ba014464222a4cd575
MD5 hash: 0d0326d690225d17bfadb1cc94209c53
humanhash: twelve-helium-social-oscar
File name:0D0326D690225D17BFADB1CC94209C53.dll
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:922'624 bytes
First seen:2023-07-08 20:30:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae9bee30dc1f7d15ed935d0e9d66e3cc (1 x AsyncRAT, 1 x QuasarRAT, 1 x XWorm)
ssdeep 12288:Cx/C7Rk8cUqsrfPzrM8IeSl+J6gFW9hK/A4IAwBlBKqZ5T5HoEOCu5q+Vge40hjB:Y/ERxsEPdI7K/aCqZ56EJ2qWVhhv20
Threatray 340 similar samples on MalwareBazaar
TLSH T15B151211FA8A64FCC869C075816796227966FCCC0F306FEF269476292D75BE03B3C658
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter abuse_ch
Tags:dll exe QuasarRAT RAT


Avatar
abuse_ch
QuasarRAT C2:
172.245.23.178:4775

Intelligence

File Origin
# of uploads :
1
# of downloads :
341
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0D0326D690225D17BFADB1CC94209C53.dll
Verdict:
No threats detected
Analysis date:
2023-07-08 20:31:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c857c23a-dccf-47a1-901f-babc7a510f17

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/412205/
Detection(s):
SecuriteInfo.com.Win64.InjectorX-gen.15928.13557.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/96626/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug donut masquerade
Link:
https://www.filescan.io/uploads/64a9c7869bd9f933fbb9017e/reports/92b52573-40c1-4685-813f-70220bc750a9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7fd426a8-f9e1-4dbc-88c3-47d35c6d8c69
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037/
Threat name:
Win64.Trojan.InjectorX
Create hunting rule
Status:
Malicious
First seen:
2023-07-04 05:47:52 UTC
File Type:
PE+ (Dll)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nd7sa4hym4blrmenbqnkbchdxt6rpjkoa6edu6hdswnxvv47ia3q._file
Verdict:
malicious
Similar samples:
09c580ea4063cb2f16bce177151628d3e9c04a87ba2c0bcb7e6d1d588b8563ed
QuasarRAT
2a530c0ce9e28ccef15ab536554c6e1174f33564d823e1cfcdb720c9771bb1cd
QuasarRAT
39bdcb0a0d32fc64451a18f340fa379cce0728360d1d4fad11fe91cf8e57754a
QuasarRAT
54250aeb90c867a9e4ed7dae2b26ecf2bd90e83172bdf4f722b99cd7f19b37f4
QuasarRAT
66aa3076bab656dc495c3a7cd2f8cfef86ffe2082d209fabe8c64905b8c76cb9
QuasarRAT
c4cd074c486e0c4cdedbc4fb8f94c97db5eaf4e56f027421d8922e0b02f3ef18
QuasarRAT
ee2e84f75b0b6043c2a2e3b84bdeabc0be4a4a1e4c6ec6a3ff255963b545425d
QuasarRAT
+ 330 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/230708-zan6waab28/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Unpacked files
SH256 hash:
68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037
MD5 hash:
0d0326d690225d17bfadb1cc94209c53
SHA1 hash:
075fde29315b4e205e7c73ba014464222a4cd575
Link:
https://www.unpac.me/results/4b513a12-37c1-4403-917b-d05e949e6ce9/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68ff2070f867/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68ff2070f86702b8b08d0c1aa088e3bcfd17a54e07883a78e3959b7ad79f4037

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/412205/

Comments