MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563
SHA3-384 hash:	568d124692b9aacc61d8a471c044226735d32ab57e40371b9e06ebf6b099a80ef35ed9de5601aa291c091a5511dacc39
SHA1 hash:	a9cd33606060dc923196acffb43e8dd3d67c6026
MD5 hash:	8eab0100f5130dc1cdbf838085b1b00c
humanhash:	north-earth-green-delaware
File name:	client.exe
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	3'266'048 bytes
First seen:	2023-12-23 01:24:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	49152:HvyI22SsaNYfdPBldt698dBcjHBU9vQBxPuoGdeTHHB72eh2NT:Hvf22SsaNYfdPBldt6+dBcjHwvd
Threatray	289 similar samples on MalwareBazaar
TLSH	T1DDE56B0437F85E33E56BD2B3D5B05022A3F1E82AF363EB1B519167BE1C53B5488426A7
TrID	37.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 29.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 8.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 6.7% (.SCR) Windows screen saver (13097/50/3) 5.3% (.EXE) Win64 Executable (generic) (10523/12/4)
Reporter	adm1n_usa32
Tags:	exe QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

325

Origin country :

RO

Vendor Threat Intelligence

CAPE Sandbox QuasarStealer

Detection:

QuasarStealer

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/469091/

ClamAV Detected

Detection(s):

Win.Malware.Generic-9883083-0

Alert

Create hunting rule

Win.Malware.Msilheracles-9900242-0

Alert

Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Downeks-6898097-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm certreq control crypto expand explorer hook infostealer keylogger lolbin quasar quasarrat rat remote replace schtasks stealer stealer

Link:

https://www.filescan.io/uploads/658636efb855eb3693ee7554/reports/6f5d81a9-4cc0-4a43-9f01-20197765b7c2/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cb5209fe-97a2-456e-ac97-5ee57f0c5903

Joe Sandbox Quasar

Result

Threat name:

Quasar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366440

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563

CERT.PL MWDB quasar

Detection:

quasar

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Quasar

Threat name:

ByteCode-MSIL.Trojan.Quasar

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-20 13:31:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

2

AV detection:

28 of 37 (75.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x7uuirkr4uaxzawvgfamchaiyqp6t7mcdtw3xfm7hchszj4umvrq._file

Threatray malicious

Verdict:

malicious

Similar samples:

2c8cda2ccc942b4eda8e1ee37a8f68c557fee80e14244f1a401321ccf1091e83

QuasarRAT

5abb3690139201632ca77d335dc003268eaf58f2fa0736fb187d843e597a2c9b

QuasarRAT

7cda27d67f0a949f2dadc47257b74d8e484a88670ca5705b190a0bed346fe7ec

QuasarRAT

bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563

QuasarRAT

c7550dc220b264239f7250607d6af8a0123107be4c377a3c94e5f8e63984b17d

QuasarRAT

e844192fb4c52758db729e18e8898fe0921bdbe1e2d3ac3da6a6b5d2cedecb71

QuasarRAT

+ 279 additional samples on MalwareBazaar

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:office04 spyware trojan

Link:

https://tria.ge/reports/231223-bsyw2agce9/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

10.166.8.157:4782

UnpacMe QuasarRAT malware_windows_xrat_quasarrat win_quasar_rat_client win_quasarrat_j2 MALWARE_Win_QuasarStealer cn_utf8_windows_terminal INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA MAL_QuasarRAT_May19_1 INDICATOR_SUSPICIOUS_Binary_References_Browsers INDICATOR_SUSPICIOUS_GENInfoStealer

Unpacked files

SH256 hash:

bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563

MD5 hash:

8eab0100f5130dc1cdbf838085b1b00c

SHA1 hash:

a9cd33606060dc923196acffb43e8dd3d67c6026

Detections:

QuasarRAT

Alert

Create hunting rule

malware_windows_xrat_quasarrat

Alert

Create hunting rule

win_quasar_rat_client

Alert

Create hunting rule

win_quasarrat_j2

Alert

Create hunting rule

MALWARE_Win_QuasarStealer

Alert

Create hunting rule

cn_utf8_windows_terminal

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Alert

Create hunting rule

MAL_QuasarRAT_May19_1

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_Binary_References_Browsers

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_GENInfoStealer

Alert

Create hunting rule

Link:

https://www.unpac.me/results/5859409b-66b3-45b9-8a74-54a48b950f5d/

VMRay QuasarRAT

Malware family:

QuasarRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bfe9444551e5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bfe9444551e5017c82d53140c11c08c41fe9fd821cedbb959f388f2ca7946563

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/469091/