MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce5be98bf208210bd0d1ba828d907f30064597f09be41d5881c082ea16101894. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce5be98bf208210bd0d1ba828d907f30064597f09be41d5881c082ea16101894
SHA3-384 hash: 2e7e38683f8f2cfe551066a8468345348c48ba6348f4a49409014e166c7df09addaf0e276ea997a8d009e27658bd3630
SHA1 hash: 01378661ee8c9444818fd50b6d0bc203fca1d7ee
MD5 hash: 45b144a45f0b107f4042f4a3f0ca4fa7
humanhash: coffee-johnny-california-oklahoma
File name:QT55.ISO
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:53'248 bytes
First seen:2021-01-12 06:19:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24:5N8hnenk8oQAJAQrkV9pFct3RtaAAIRddcOeaeDVud:5N8hnak8oQAJ7mFcFy5OdeVu
TLSH B333051B1B42441CCA989A3140B475589B37F0C91BB3E207F98D98284F9FFD96F22395
Reporter abuse_ch
Tags:iso QuasarRAT RAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: spfilter-1.sel01.mschosting.com
Sending IP: 110.4.41.65
From: TheBill #14448435421 <FreeBill-id1444843@domain.com>
Subject: your order has been placed##144484
Attachment: QT55.ISO (contains "QT55.vbs")

QuasarRAT payload URL:
https://z.zz.ht/nlOiE.jpg

QuasarRAT C2:
sdffgre.myq-see.com:9999 (51.89.204.178)

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ISB.Downloadergen48.24916.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce5be98bf208210bd0d1ba828d907f30064597f09be41d5881c082ea16101894/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-12 06:20:06 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zzn6tc7sbaqqxugrxkbi3ed7gadelf7qtpsb2webycboufqqdcka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce5be98bf208210bd0d1ba828d907f30064597f09be41d5881c082ea16101894

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

iso ce5be98bf208210bd0d1ba828d907f30064597f09be41d5881c082ea16101894

(this sample)

QuasarRAT

Visual Basic Script (vbs) vbs 2f99e627f3cf5b119435e4e247366ccd20a0379c6fa47673cbd66976693ecee1

  
URLhaus
https://urlhaus.abuse.ch/url/954554/
  
Dropping
MD5 eebb3ed4fb31b7beabc7ef18c4136502
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f99e627f3cf5b119435e4e247366ccd20a0379c6fa47673cbd66976693ecee1

Comments