MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc
SHA3-384 hash: 144adf0e01adc352550c4684afdb87c5508b4c15446f4ac8a76b9664cb1ca10e2d93c648b16650ed80cfccd9b49adbaf
SHA1 hash: 6cecccd93571c3a2994597813061f39ecc8890bc
MD5 hash: f905123f4a3c9c95cd51dc0ee433ba8f
humanhash: potato-snake-papa-zebra
File name:massive_soi_dog.js
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:260'728 bytes
First seen:2023-08-10 05:53:20 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:fNrVFO5tNy6NpepemGOnNM3N9NHAAAAAA/PNtiNWtNa4Ntq2ENGkNgx2Nyp1wN2c:lGepemnUOV
TLSH T1EB44771025DFA48CB2723E5317ED36AA4F57FBB65B3AA16E2004034B5B97D40CE95B32
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter ankit_anubhav
Tags:js QuasarRAT TA558

Intelligence

File Origin
# of uploads :
1
# of downloads :
361
Origin country :
TH TH
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Obfus-101.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-2314.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Labled as:
JS/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc
Result
Verdict:
MALICIOUS
Result
Threat name:
Clipboard Hijacker, Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1289158
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to hide user accounts
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Generic Downloader
Yara detected Quasar RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1289158 Sample: massive_soi_dog.js Startdate: 10/08/2023 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 9 other signatures 2->45 8 wscript.exe 1 2->8         started        process3 signatures4 47 JScript performs obfuscated calls to suspicious functions 8->47 49 Suspicious powershell command line found 8->49 51 Wscript starts Powershell (via cmd or directly) 8->51 11 powershell.exe 15 17 8->11         started        process5 dnsIp6 27 24.152.37.111, 49696, 49698, 5552 MasterDaWebBR unknown 11->27 29 uploaddeimagens.com.br 188.114.96.7, 443, 49695 CLOUDFLARENETUS European Union 11->29 31 192.168.2.1 unknown unknown 11->31 53 Suspicious powershell command line found 11->53 55 Creates autostart registry keys with suspicious values (likely registry only malware) 11->55 57 Writes to foreign memory regions 11->57 59 2 other signatures 11->59 15 RegAsm.exe 15 2 11->15         started        19 RegAsm.exe 11->19         started        21 powershell.exe 11 11->21         started        23 conhost.exe 11->23         started        signatures7 process8 dnsIp9 33 ip-api.com 208.95.112.1, 49697, 80 TUT-ASUS United States 15->33 35 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->35 37 May check the online IP address of the machine 19->37 25 conhost.exe 21->25         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc/
Threat name:
Script-JS.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-08-10 05:54:06 UTC
File Type:
Text (JavaScript)
AV detection:
3 of 38 (7.89%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xjbg2q3tbfthq5edh5qn444xlf7bpjw2uwp2ykamxzv63aqbsxoa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/230810-gvwgksad97/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Blocklisted process makes network request
Malware Config
Dropper Extraction:
https://uploaddeimagens.com.br/images/004/563/341/original/js.jpg?1690914842
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/ba426d437309667874833f60de7397597e17a6daa59fac280cbe6bed820195dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments