MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab8e71a8035999799c88b25d8bd33d1ab5ca07075320e50f30cba174c7b82b4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab8e71a8035999799c88b25d8bd33d1ab5ca07075320e50f30cba174c7b82b4a
SHA3-384 hash: 7dc71aa7f412157641fa04794f09c243b346b0e56aef2bb72c17dbb8ad88ac01812205bc464ef41f18e018afe65b4f43
SHA1 hash: 3f5421efc2bb2cde724a2401623eb7540b011bbb
MD5 hash: 45826c23721f6642b7e3110abff8e42e
humanhash: fish-mars-undress-december
File name:45826c23721f6642b7e3110abff8e42e.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'369'600 bytes
First seen:2020-11-16 19:14:04 UTC
Last seen:2020-11-16 20:42:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f5f620bd070ad6b6214b903ee2a79e87 (1 x AgentTesla, 1 x QuasarRAT)
ssdeep 24576:ePll++pMDpVwt/56mUc2UE2tBNrZMZk0X/XL3g4A/GMHaBx4h3fkyauze9:ulcVDpuVwmqUEyNWeAPL3g4xTBx4mT9
Threatray 1 similar samples on MalwareBazaar
TLSH E0551210B5A18436E0B121371679E77A153EBE340B149EEFA7989A7CDE342D01235F7B
Reporter abuse_ch
Tags:exe nVpn QuasarRAT RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.5171.29397.13704.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Setting a keyboard event handler
Creating a file in the %AppData% subdirectories
Creating a window
Connection attempt to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/538405
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to disable the Task Manager (.Net Source)
Contains functionality to hide user accounts
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab8e71a8035999799c88b25d8bd33d1ab5ca07075320e50f30cba174c7b82b4a/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 19:15:08 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vohhdkadlgmxtheiwjoyxuz5dk24ubyhkmqokdzqzoqxjr5yfnfa._file
Verdict:
unknown
Similar samples:
7d69ecaf108320a941b846030a0438843d5cc4ea8067807b7db4b783c1fffa60
QuasarRAT
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201116-3x3dxrwxks/
Unpacked files
SH256 hash:
ab8e71a8035999799c88b25d8bd33d1ab5ca07075320e50f30cba174c7b82b4a
MD5 hash:
45826c23721f6642b7e3110abff8e42e
SHA1 hash:
3f5421efc2bb2cde724a2401623eb7540b011bbb
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
SH256 hash:
3a96d9a797a3b6b3ea0d8264ed1078508df9557e2f453217d52a75907f9b9465
MD5 hash:
547ebc92cac936d8c3459d2765948f4a
SHA1 hash:
09c143d609b65b19a97289ca7645df2a0bc39c83
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
SH256 hash:
c1428ec7129ad3e36dad35d8992602cefcd6a593952834897424314fe029dd4b
MD5 hash:
67ca4c5eed9cab4b08064d4314dc0a86
SHA1 hash:
61dfa1d80d9e6b506d29e3897dd3ca08ade30988
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
Parent samples :
a53a585de940ceb15a7b30f6d6157b0e9722d7b81cea4a2dadb1f0c7410fae87
e2cc914a1df535f2cf88007a518a9990afe5ccdb9cf1262e550e2ce8cc9c7eb0
fbe788dd0db451b33c60b855c9aa18af0d2b87140cfa25a0a78be290d10089cc
ace5504608d43d701becbb246abe3c7b0483fd3904c13a5677084e6f98ef0271
d4e3e9ccf34249744cc8bbeba02fb11626604b8093edc8d85326b467e6aeb7b1
326e0518dab187c2786ffb1429a71dc764ef82211aaf59bcd3a8a78c01579283
2a8c219afd3d9e171dc1515b32185bad9172bbcdaf15a6a7502458b6e7553ff5
8c5659ff1e439fdb199c25ac76fb8d3e9c45b702ac8c99073ccdf7fd1f9cdbfd
SH256 hash:
09eafa5f7ff23580b2ccd6c72aa3512b6d6ceb947e8c947148cdbf07de4b12c1
MD5 hash:
eb3fb6adf4932af21acd62994af8e4f8
SHA1 hash:
6cf5aa89bc1c523cc4395f9c6f72db88620f5345
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
SH256 hash:
3db2b0c012e3e770548b36eb84ea2278f34dfda82a269fc30f38e743b33855e3
MD5 hash:
ef33c4c8efc8c1b355ad64e12b010070
SHA1 hash:
ac30158d8bd81ec0b728a299c9e72789b4f33f31
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
SH256 hash:
542be6a092437c47aec4c046bf4636f9a3153954b0384141b8cc2922d68a38b5
MD5 hash:
bfb7da75069724d5ec80b44bc2e46d9f
SHA1 hash:
fe757e6a079f7be6efa5d15df7260792560f6576
Link:
https://www.unpac.me/results/852f5ea3-da41-4a0f-b096-7eeb74fb1014/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ab8e71a80359/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Choice_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Quasar
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:RDPWrap
Create hunting rule
Author:@bartblaze
Description:Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:https://github.com/stascorp/rdpwrap
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Executable exe ab8e71a8035999799c88b25d8bd33d1ab5ca07075320e50f30cba174c7b82b4a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/807238/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/807263/

Comments