MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027
SHA3-384 hash:	2867c4b3f8f9e9c6e3068ba8d56b2ad74ec66b911a1461c83b2287a62d1c5e28597992c030c6acec0e54a5abe958f483
SHA1 hash:	3eb8d7d6cfb24ead4c8a417e374053029301a1ac
MD5 hash:	43e01ba3077ac42632292b7ddfb47275
humanhash:	sixteen-eight-venus-hydrogen
File name:	file
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	3'266'048 bytes
First seen:	2023-12-28 16:29:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	49152:QvnW1i2R+at/C4PAlOqmicAhHzlK8RJ6BbR3LoGdYTHHB72eh2NT:QvW1i2R+at/C4PAlOqmVAhHzlK8RJ6j
Threatray	295 similar samples on MalwareBazaar
TLSH	T113E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
TrID	37.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 29.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 8.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 6.7% (.SCR) Windows screen saver (13097/50/3) 5.3% (.EXE) Win64 Executable (generic) (10523/12/4)
Reporter	jstrosch
Tags:	.NET exe MSIL QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

315

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox QuasarStealer

Detection:

QuasarStealer

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469525/

ClamAV Detected

Detection(s):

Win.Malware.Generic-9883083-0

Alert

Create hunting rule

Win.Malware.Msilheracles-9900242-0

Alert

Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Downeks-6898097-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

DNS request

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm certreq control crypto expand explorer hook infostealer keylogger lolbin quasarrat rat remote replace schtasks stealer stealer

Link:

https://www.filescan.io/uploads/658da290ffafd83ebc9e740d/reports/0b73ab7e-951c-4ea5-b4df-c0539e6fd54b/overview

Hybrid Analysis Trojan.MSIL.Quasar

Verdict:

Malicious

Labled as:

Trojan.MSIL.Quasar

Link:

https://www.hybrid-analysis.com/sample/729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/da185a02-b8d0-4b34-b1c4-7747b8eebeef

Joe Sandbox Quasar

Result

Threat name:

Quasar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1367735

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027

CERT.PL MWDB quasar

Detection:

quasar

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Quasar

Threat name:

ByteCode-MSIL.Trojan.Quasar

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-28 16:30:14 UTC

File Type:

PE (.Net Exe)

Extracted files:

2

AV detection:

19 of 22 (86.36%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oknafzxryntzb4zbjdkzovxyjvbxrak5n6nzqydct6q7myt76atq._file

Threatray malicious

Verdict:

malicious

Similar samples:

2c8cda2ccc942b4eda8e1ee37a8f68c557fee80e14244f1a401321ccf1091e83

QuasarRAT

3301b53caeb2482dda0672a4f99b1032a76cb3393407a39017a4bc8e3069fd75

QuasarRAT

5abb3690139201632ca77d335dc003268eaf58f2fa0736fb187d843e597a2c9b

QuasarRAT

7cda27d67f0a949f2dadc47257b74d8e484a88670ca5705b190a0bed346fe7ec

QuasarRAT

c7550dc220b264239f7250607d6af8a0123107be4c377a3c94e5f8e63984b17d

QuasarRAT

e844192fb4c52758db729e18e8898fe0921bdbe1e2d3ac3da6a6b5d2cedecb71

QuasarRAT

+ 285 additional samples on MalwareBazaar

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:lab0team spyware trojan

Link:

https://tria.ge/reports/231228-tzs88seedq/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates physical storage devices

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

lab0team.net:4003
lab0team.net:3333
lab0team.net:3003
lab0team.net:1433
lab0team.net:30303
lab0team.net:43030

UnpacMe QuasarRAT malware_windows_xrat_quasarrat win_quasarrat_j2 MALWARE_Win_QuasarStealer cn_utf8_windows_terminal INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA MAL_QuasarRAT_May19_1 INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_GENInfoStealer

Unpacked files

SH256 hash:

729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027

MD5 hash:

43e01ba3077ac42632292b7ddfb47275

SHA1 hash:

3eb8d7d6cfb24ead4c8a417e374053029301a1ac

Detections:

QuasarRAT

Alert

Create hunting rule

malware_windows_xrat_quasarrat

Alert

Create hunting rule

win_quasarrat_j2

Alert

Create hunting rule

MALWARE_Win_QuasarStealer

Alert

Create hunting rule

cn_utf8_windows_terminal

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Alert

Create hunting rule

MAL_QuasarRAT_May19_1

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_GENInfoStealer

Alert

Create hunting rule

Link:

https://www.unpac.me/results/0b987af2-682d-4a82-8c08-23696a702b99/

VMRay QuasarRAT

Malware family:

QuasarRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/729a02e6f1c3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

exe 729a02e6f1c36790f32148d59756f84d4378815d6f9b9860629fa1f6627ff027

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/469525/