MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ed14885068667e9de2ede24522ab5e7bc2b02ed2f5953d590517921a3d77f4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 9 File information Comments

SHA256 hash:	7ed14885068667e9de2ede24522ab5e7bc2b02ed2f5953d590517921a3d77f4f
SHA3-384 hash:	fe1bf9247c913508e6b4cc42f257d1c36bcdb00c8dcdd47c67abfaba3fd5acd289617f6e28739b91b1b0966fa8c09aa4
SHA1 hash:	8600342fd830abe4646587bb72c9be37ec777ae8
MD5 hash:	5a34a9d0de10945fc472f2bfe3565ce6
humanhash:	juliet-cardinal-mexico-texas
File name:	Payment-terms_pdf.exe
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	839'680 bytes
First seen:	2020-05-21 08:08:36 UTC
Last seen:	2020-05-21 08:52:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	213f5203813b81c2b28bcb1d067b9de7 (3 x Loki, 3 x AgentTesla, 2 x HawkEye)
ssdeep	12288:1R8OmEiq8jcTKQx/WcATgiBft2Ezt1X4NhvkxF5+WvFGcAVHY618mbjE7U:1yHE2jW9sNpLjWvu5rFrAVHx19bZ
Threatray	2'481 similar samples on MalwareBazaar
TLSH	B405C026F6A04833C073153E5C1B56A89825BE913F2B5A76EBE51C4C6F3B75339E4283
Reporter	abuse_ch
Tags:	exe QuasarRAT RAT

abuse_ch

Malspam distributing QuasarRAT:

HELO: hansoll.com
Sending IP: 103.145.255.184
From: HANSOLL TEXTILE LTD<sopark@hansoll.com>
Subject: Regarding Change of Payment Due Date Terms
Attachment: Payment-terms_pdf.gz (contains "Payment-terms_pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Packer.BorlandDelphi-15

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.12176.11480.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-21 14:05:26 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p3iurbigqzt6txro3ysfekvv466cwaxnf5mvhvmqkf4sdi6xp5hq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

QuasarRAT

295c508d5a38496e158e8ae8795196bfa24a12d1aabc2e528a133b41e6723ed2

QuasarRAT

2e6d01252c1c1469683b9412b4f2eefcd05bd8b433c8811b72ea0ab717cd1615

QuasarRAT

7482b140488cd74ef0403293fac39ef04971a50072ab191dd84ec9471b2f0b25

QuasarRAT

81e1b005ad6288e3342303bb5f923ac974cd409220848cb371c0fdac7f7af6a4

QuasarRAT

a1328c630411d6556c3be98688d62cda121f88cea39058fae39fab4dbb3b9697

QuasarRAT

b719eaba75908554a45c1d6032761dadd07519d2acbf2d0e34adb9edf6adf343

QuasarRAT

cb571afc1d03fa78ed4195ba460af43eaf613b09630fd49c5425b88d1378f437

QuasarRAT

cc3fd37b6617c61fb8972c9dbe5cd10268d11ecaa99b701070da7776135e16cc

QuasarRAT

da866a078435360a2134c5526de8d10a68d5d028aa0decddcc9902748ca42f31

QuasarRAT

+ 2'471 additional samples on MalwareBazaar

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar evasion spyware trojan upx

Link:

https://tria.ge/reports/201109-kdj4ejrv2j/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Loads dropped DLL

Windows security modification

Executes dropped EXE

UPX packed file

Modifies Windows Defender Real-time Protection settings

Quasar RAT

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Certutil_Decode_OR_Download Create hunting rule
Author:	Florian Roth
Description:	Certutil Decode
Reference:	Internal Research

Rule name:	CN_disclosed_20180208_KeyLogger_1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	MAL_BackNet_Nov18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects BackNet samples
Reference:	https://github.com/valsov/BackNet

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/