MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0cd9c51c4fc4f7805d5d2e5e08e3701c2214ab9ee25a239b2ab3c7af0c8e797. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0cd9c51c4fc4f7805d5d2e5e08e3701c2214ab9ee25a239b2ab3c7af0c8e797
SHA3-384 hash: ea021236157ef8b7e42bcf605218e0fc4cf65a54b8009bce4cd22bd593c169b0c33a3fc0dc4e671dbaa2a2730341b2c7
SHA1 hash: 7eabf94ea15bef9d48100159ff54e5117d7ead77
MD5 hash: 11767ecb9deb6b80bf781e6f47b859d5
humanhash: south-salami-equal-blossom
File name:file
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:356'352 bytes
First seen:2020-02-25 13:16:13 UTC
Last seen:2020-02-27 14:02:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'855 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 6144:PyUhIvTCqL/0+Ad3zEGMcQbzGD5VeKyvh1UGoAhQqwO:qNTCKxANEKemqsGoAqqwO
Threatray 78 similar samples on MalwareBazaar
TLSH D2748D1377A4D93BE1FE173AE03206194BB4D913B616E3CB5A5A55BD2D233868D803B3
Reporter johannes
Tags:QuasarRAT


Avatar
viql
quasarrat via https://pastebin.com/raw/9Ld1YZnH

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-7663588-0
Create hunting rule

Win.Trojan.Generic-6295765-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Tinclex
Create hunting rule
Status:
Malicious
First seen:
2020-02-25 19:06:00 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydgzyuoe7rhxqbov2ls6bdrxahbccsvz5ys2eonsvm6hv4gi46lq._file
Verdict:
malicious
Similar samples:
0eaa5bbea25ef06214bc21deab41eb7f5bdcdd4c24b0297a28607d30edf65ae1
QuasarRAT
1f39ddbeb7fb355469a2ccc2cffda9006ca641562dc8dd300e855bb2fe2e33de
QuasarRAT
2fd0f9d77de102d8b53f3d38eb559d2cd0d0e9f4ba3cfbc042f952367b5ca65e
QuasarRAT
588eb55b57e118fbee66a6d0586de453ea4e0ae1a781c73e1bbe10e8e24641fc
QuasarRAT
5eb26eb056480f6083f7565a572b2dd6ebc992a99d8220dbf0d736c7b4a12077
QuasarRAT
8fcf4d1528f2945b751c3d9035e17f7143fdbc94ef687f5c9e4e35d892c5922b
QuasarRAT
960ee0a08a3b542c30baa19546f38f1eeeab56543997dc338e79273b0dcecc23
QuasarRAT
a4e79d826cc13a421a5b3b785413d92254992bceb6d392c72de16b61653b346f
QuasarRAT
ba9fd12aa57da28572f82eb2010a44b89a9cc1c9738f801fec02f44857163b8f
QuasarRAT
d478602bac8b8f334f06644dd92fbe60cbba6815ced96503c7aab4df6f305e77
QuasarRAT
+ 68 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar spyware trojan
Link:
https://tria.ge/reports/201109-d63xdkajjx/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Quasar RAT
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0cd9c51c4fc4f7805d5d2e5e08e3701c2214ab9ee25a239b2ab3c7af0c8e797

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments