MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c1e62385d660ca43e024d461154fbb4805e429cdf7850d19510d7f69533739e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c1e62385d660ca43e024d461154fbb4805e429cdf7850d19510d7f69533739e
SHA3-384 hash: 834c137a9a1046ea1b6a7d0c14061452b7a46e29b089a53f7ce5c331f58dcf0267d45aa88218d3c9110c7ec45d03a92a
SHA1 hash: 6a93921485cbd83382eb5a47315b1f0a67bcf684
MD5 hash: 970aca768e68faa580f758a1a379686b
humanhash: robin-eleven-chicken-violet
File name:ss.ps1
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:5'387'721 bytes
First seen:2023-01-19 17:08:06 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 49152:CY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+s:E
Threatray 1'550 similar samples on MalwareBazaar
TLSH T154461136CA31BCD4871C3700A7251CAF21A96557D3F74E28CB162CBA3D72B52EF65988
Reporter Anonymous
Tags:ps1 QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/63c9792fbcc9b64a44de672a/reports/7daf37f5-7c8c-415d-b569-6d00fd70c1e1/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1154916
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Snort IDS alert for network traffic
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c1e62385d660ca43e024d461154fbb4805e429cdf7850d19510d7f69533739e/
Threat name:
Script-PowerShell.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-01-17 23:19:37 UTC
File Type:
Text (VBS)
AV detection:
6 of 39 (15.38%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqpgeoc5mygkipqcjvdbcvh3wsaf4qu4354fbumvcdl7nfjtoopa._file
Verdict:
malicious
Similar samples:
163f0f159705867530e310ee48ffb66a057fba8a236ca2473c3de1d2f9ea48c9
QuasarRAT
76157646cba06f9895750597b70f8f0aadf2028f8c16f2f23cb06100b7f76d06
QuasarRAT
8fbfd2c152ea1f87420d34a34f5125e8720df6bacc9210fba6aede8a7507e9b4
QuasarRAT
98d3b57828ef63c0e91b466c6c4fd45ba78b04b9bae07c62b7b36ee7e25337b6
QuasarRAT
a5611f035268a9084594b7b0095ff6c76add006c7a492f2123f5f39916b93546
QuasarRAT
a9c8290ab786fc98bf2f41382a4f717b7a454fa630979127bc343485b9871b12
QuasarRAT
d5af77fbabd67255d4d1f3e31f0379496c8dd2401198f663e9dc25c64851d5e2
QuasarRAT
+ 1'540 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:office04 spyware stealer trojan
Link:
https://tria.ge/reports/230119-vn4q9sgf67/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
ghcc.duckdns.org:4782
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6c1e62385d66/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c1e62385d660ca43e024d461154fbb4805e429cdf7850d19510d7f69533739e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

PowerShell (PS) ps1 6c1e62385d660ca43e024d461154fbb4805e429cdf7850d19510d7f69533739e

(this sample)

  
Delivery method
Distributed via web download

Comments