MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 19 File information Comments 1

SHA256 hash:	d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c
SHA3-384 hash:	a011a6db40ab47be3988dc6e651ff615b4c7721f6772679f1ac9d3eab0c7f48bfab901019f769621f27b8fc5fac05982
SHA1 hash:	162617d555f9b86163bfc880ce58827c60f930ad
MD5 hash:	baf9e70d6d5b3958acf03df4671a4f48
humanhash:	butter-missouri-east-johnny
File name:	baf9e70d6d5b3958acf03df4671a4f48
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	960'000 bytes
First seen:	2022-12-08 11:14:32 UTC
Last seen:	2022-12-08 12:47:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:g9cfZf1yNZl0NHR/icRqiFpyEvfmQiNB:tfLyNZq1V3FvvS
TLSH	T1FB15028C356172DED827C8369EA86C78EE5164BB531F0203E86715EDEA5C897CF180F6
TrID	28.5% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 13.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 12.2% (.EXE) Win32 Executable (generic) (4505/5/1) 5.6% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):
dhash icon	0763a5d2f85c2717 (5 x QuasarRAT, 2 x AveMariaRAT)
Reporter	zbetcheckin
Tags:	32 exe QuasarRAT

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/344307/

Detection(s):

PUA.Win.Packed.ConfuserEx-6391397-0

PUA.Win.Packed.ConfuserEx-6582917-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Creating a file in the %AppData% subdirectories

Launching a process

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

confuserex packed

Link:

https://www.filescan.io/uploads/6391c73904e0e79bdf4179a0/reports/36a0368e-047b-46f0-8f1f-40a491183862/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Quasar RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3de58585-abec-4c0f-bc6f-44e4d6bec70f

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1130654

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file contains section with special chars

PE file has nameless sections

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2022-12-08 11:15:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3fdsf564r3r6ou2rwu3g5aftkkeyo4cxvkzmhsxbg7uvhqwshmwa._file

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:roop spyware trojan

Link:

https://tria.ge/reports/221208-nckqpahg82/

Behaviour

Creates scheduled task(s)

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Looks up external IP address via web service

Loads dropped DLL

Executes dropped EXE

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

dnuocc.com:64594
www.dnuocc.com:64594

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/82fd3d92-a043-4847-a979-4a53bc140930

Unpacked files

SH256 hash:

361d2e7ad838798c08d9ca2e9e60be4b18750f1e0eafa52ab858f06183f01c77

MD5 hash:

149981e461a17a6296a4fbd098a90eec

SHA1 hash:

6c0328bdf17c442bea071cb47fd66bfc95feb8d2

Link:

https://www.unpac.me/results/eb523bf9-afa2-4b45-a98a-8f60286cee53/

SH256 hash:

94a74a4a57519b2fd1a5d5fce6ce7615a6610d69152962b4a0c0f7c5df08b9b3

MD5 hash:

5c3e0e47f277ea6f8574fe5b91733050

SHA1 hash:

684758647e91f14b62838cb3072fada9f413d509

Link:

https://www.unpac.me/results/eb523bf9-afa2-4b45-a98a-8f60286cee53/

SH256 hash:

d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c

MD5 hash:

baf9e70d6d5b3958acf03df4671a4f48

SHA1 hash:

162617d555f9b86163bfc880ce58827c60f930ad

Link:

https://www.unpac.me/results/eb523bf9-afa2-4b45-a98a-8f60286cee53/

Malware family:

xRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d94722f7dc8e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.54

Link:

https://yomi.yoroi.company/submissions/d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_KeyLogger_1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	CN_disclosed_20180208_KeyLogger_1_RID3227 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	malware_Quasar_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect QuasarRAT in memory

Rule name:	MALWARE_Win_QuasarRAT Create hunting rule
Author:	ditekSHen
Description:	QuasarRAT payload

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MAL_QuasarRAT_May19_1_RID2E1E Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	pe_imphash Create hunting rule

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_1_RID2B54 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2_RID2B55 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/

Rule name:	Windows_Trojan_Quasarrat_e52df647 Create hunting rule
Author:	Elastic Security

Rule name:	xRAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Patchwork malware
Reference:	https://goo.gl/Pg3P4W

Rule name:	xRAT_1_RID2900 Create hunting rule
Author:	Florian Roth
Description:	Detects Patchwork malware
Reference:	https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

exe d94722f7dc8ee3e75351b5366e80b35289877057aab2c3cae137e953c2d23b2c

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/344307/

URLhaus

https://urlhaus.abuse.ch/url/2451272/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-12-08 11:14:46 UTC

url : hxxps://js-hurling.com/wrcontents/qzghjkdhdxgf.exe