MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 25 File information Comments

SHA256 hash:	8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91
SHA3-384 hash:	6d46a8cb0281ac386f991b937297a744e4ee708cddb04b9b8b6010d68281feb1c942fc228657d6cda2781a3d51a2edca
SHA1 hash:	cc3c5fdc6a454955d1c5158a42d668abf616e748
MD5 hash:	19ec1b3fe77ac2bb9b4019ecf20cfc5b
humanhash:	carbon-finch-network-lemon
File name:	xqnoOIWFbr2N.exe
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	356'352 bytes
First seen:	2023-10-04 12:19:22 UTC
Last seen:	2023-10-09 13:34:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:b2NHXf500M7fN3hDQorkb3aUQ0gdsx9+I6WGldC:id50xl3hcymQbsH+pWG3C
Threatray	462 similar samples on MalwareBazaar
TLSH	T1ED748C1377E8EA3BD1FD273AF43206154BB4D44B7616E38B5A5865F82C223868D903B7
TrID	53.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 12.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.5% (.SCR) Windows screen saver (13097/50/3) 7.6% (.EXE) Win64 Executable (generic) (10523/12/4) 4.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter	pmelson
Tags:	exe QuasarRAT VoidRAT

Intelligence

File Origin

# of uploads :

# of downloads :

338

Origin country :

Vendor Threat Intelligence

Malware family:

quasar

ID:

File name:

8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91.zip

Verdict:

Malicious activity

Analysis date:

2023-10-04 12:31:01 UTC

Tags:

rat quasar evasion remote

Link:

https://app.any.run/tasks/165a9402-2b43-41ed-8dda-42dd7d82157f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Generic-9829635-0

Win.Trojan.Generic-9829636-0

Win.Packed.Generic-9830106-0

Win.Trojan.Generic-6295765-0

Win.Malware.Generic-6623004-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Setting a keyboard event handler

Creating a file in the %AppData% subdirectories

Creating a window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

infostealer keylogger lolbin quasar quasarrat rat shell32 stealer stealer vermin xrat

Link:

https://www.filescan.io/uploads/651d58734d45a517a340c295/reports/df198400-2092-4188-b3cc-9c356388883f/overview

Verdict:

Malicious

Labled as:

Trojan.MSIL.Agent

Link:

https://www.hybrid-analysis.com/sample/8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Quasar RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f8ef21b-2838-4947-9b22-bf3bc5b616b3

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1319419

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

quasar

Link:

https://mwdb.cert.pl/sample/8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2023-10-04 12:20:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ro7qcpq2bfpvqqnvolqkvxdmheuvgozdgjra7jdq7zphis4croiq._file

Verdict:

malicious

QuasarRAT

03507849f9ee5ca0a1722fdfd761d25e471050d228492f530ef0183d8a68aa7c

QuasarRAT

57d232a7ac403bd7e30412198520fc951f9e102337fe195efdd10954970b0432

QuasarRAT

a44e7420e441548adddf0d79cc51e46211ebfa7dde08e5c95211eb3f95d0e570

QuasarRAT

b78e68fd36980a2fa7c1de03af87095dc637985959414c9684b11c24d37e97b3

QuasarRAT

be4b01360068f60b192c4a2e1a4ebb3e49070887c9e98add3a71a3676f05b9ba

QuasarRAT

+ 452 additional samples on MalwareBazaar

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:newdns spyware trojan

Link:

https://tria.ge/reports/231004-phra4adf37/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

usacupid.org:3000

Unpacked files

SH256 hash:

8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91

MD5 hash:

19ec1b3fe77ac2bb9b4019ecf20cfc5b

SHA1 hash:

cc3c5fdc6a454955d1c5158a42d668abf616e748

Detections:

QuasarRAT

Link:

https://www.unpac.me/results/9f5c7a0e-c441-4b88-b30b-2a1a641f1ec8/

Malware family:

QuasarRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8bbf013e1a09/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_KeyLogger_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	CN_disclosed_20180208_KeyLogger_1_RID3227 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	malware_Quasar_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect QuasarRAT in memory

Rule name:	MALWARE_Win_QuasarRAT Create hunting rule
Author:	ditekSHen
Description:	QuasarRAT payload

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Description:	Detects QuasarRAT malware

Rule name:	MAL_QuasarRAT_May19_1_RID2E1E Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	@SOCRadar
Description:	Detects Quasar RAT

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_1_RID2B54 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2 Create hunting rule
Description:	Detects Quasar RAT

Rule name:	Quasar_RAT_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2_RID2B55 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/

Rule name:	Windows_Trojan_Quasarrat_e52df647 Create hunting rule
Author:	Elastic Security

Rule name:	win_quasar_rat_client Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in Quasar Rat Samples.

Rule name:	xRAT_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Patchwork malware
Reference:	https://goo.gl/Pg3P4W

Rule name:	xRAT_1_RID2900 Create hunting rule
Author:	Florian Roth
Description:	Detects Patchwork malware
Reference:	https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

exe 8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91

(this sample)

Link

https://www.virustotal.com/gui/file/8bbf013e1a095f5841b572e0aadc6c3929533b2332620fa470fe5e744b828b91/detection

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample