MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe
SHA3-384 hash:	b5be5cea14270737e96466c93ac35167b664eda119a2a1eb839a877bd8d75d79022fd8609e6e9f777801c6c2e3f04900
SHA1 hash:	436e53d4a0bd510cfe242244a8d58855cb78ed18
MD5 hash:	b5eb699845a8e943a788280ed8b27517
humanhash:	angel-november-robin-edward
File name:	file.exe
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	4'391'424 bytes
First seen:	2023-05-14 07:53:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ef95916dd097e49708f7a909e91f42c9 (1 x QuasarRAT)
ssdeep	98304:420RJx1z4xKUHmqwwbjBJT5vLuAyuZf/Wq/7kcaT65Z:aRJxdEbjljuAyIfeqjkWZ
TLSH	T126163306B0D188F1E17129310AF25BB5623E7D6309F1D8A767EC0B5F8FB56426B22637
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	abuse_ch
Tags:	exe QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

300

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN quasar

Malware family:

quasar

Alert

Create hunting rule

ID:

1

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2023-05-14 07:54:40 UTC

Tags:

quasar

Link:

https://app.any.run/tasks/4b334217-af87-455f-b39a-7fbfd87df276

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox QuasarStealer

Detection:

QuasarStealer

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/389294/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.Evo-gen.20511.31441.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching a process

DNS request

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/64609399279d34f5dc64bdcf/reports/9488822e-7f57-4321-897a-ac8b496bf537/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/06ced1e5-651d-4ada-9e96-73c8f401a735

Joe Sandbox Quasar

Result

Threat name:

Quasar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1232673

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Writes to foreign memory regions

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-05-14 07:54:07 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pdvzqkv57m4fvqxazgtebblao43zgvprnyuxrbcwuzkryftlad7a._file

Threatray unknown

Verdict:

unknown

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:office04 spyware trojan

Link:

https://tria.ge/reports/230514-jrhsesde2v/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

217.196.96.37:5678

UnpacMe QuasarRAT

Unpacked files

SH256 hash:

e5a9b8822e260937502bee4d1a290781002981f41156574e671e7c74211756d5

MD5 hash:

2ce8d78bc26c1378f37fb6efa4c75121

SHA1 hash:

72ad02c357fa89243c9a5b3ce76b6a1cfb106568

Detections:

QuasarRAT

Alert

Create hunting rule

Link:

https://www.unpac.me/results/03accdc3-4047-4b4c-a53d-fe0625634dd4/

SH256 hash:

78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe

MD5 hash:

b5eb699845a8e943a788280ed8b27517

SHA1 hash:

436e53d4a0bd510cfe242244a8d58855cb78ed18

Link:

https://www.unpac.me/results/03accdc3-4047-4b4c-a53d-fe0625634dd4/

VMRay QuasarRAT

Malware family:

QuasarRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/78eb982abdfb/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/78eb982abdfb385ac2e0c9a640856077379355f16e29788456a6551c166b00fe

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/389294/