MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e73cf978acde72a0ec094a6fe4302cd7e369624fe183057d01a1c47fd878324f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 8 File information Comments

SHA256 hash:	e73cf978acde72a0ec094a6fe4302cd7e369624fe183057d01a1c47fd878324f
SHA3-384 hash:	da8e24f60a03cd065ed1501ed4552547bc02e0fa065b56c3e3c0b4301cbb1d687b531499e09a4451a7de90bd2953982e
SHA1 hash:	38efd87f1abf86c1e83b5b392b7791e8762d5468
MD5 hash:	818b88a1598bff8b646a6b46e1fd1d99
humanhash:	wyoming-violet-rugby-single
File name:	rVsuR0Kf.exe
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	356'864 bytes
First seen:	2020-10-03 08:02:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:QGqQ4i1FFiEKGnNHbLDk5bTqD5DKL20DJzQfVO:vpliKHPY8SJJk9O
Threatray	88 similar samples on MalwareBazaar
TLSH	1F749D1373A4D57BE1FE173AE43206084BB0D853BB16E3CB5A5A55B92D133868E907B3
Reporter	pmelson
Tags:	exe QuasarRAT VoidRAT

Intelligence

File Origin

# of uploads :

# of downloads :

250

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Win.Trojan.Generic-6295765-0

Win.Malware.Generic-6623004-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Sending a UDP request

DNS request

Sending an HTTP GET request

Setting a keyboard event handler

Creating a file in the %AppData% subdirectories

Creating a window

Connection attempt to an infection source

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/480721

Signature

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

quasarrat

Link:

https://mwdb.cert.pl/sample/e73cf978acde72a0ec094a6fe4302cd7e369624fe183057d01a1c47fd878324f/

Threat name:

ByteCode-MSIL.Backdoor.QuasarRAT

Status:

Malicious

First seen:

2020-10-03 08:04:09 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=446ps6fm3zzkb3ajjjx6imbm27rwsysp4gbqk7ibuhch7wdygjhq._file

Verdict:

malicious

QuasarRAT

06749098537b1e1e031e5d568e5e6d3f0bd89ca921953909b42c271b0a3fe5f0

QuasarRAT

0eaa5bbea25ef06214bc21deab41eb7f5bdcdd4c24b0297a28607d30edf65ae1

QuasarRAT

17a3a230d310ff684cf08306fe34d13c9505ac612942875a19c98b5d000119b0

QuasarRAT

2801e23864a2d65490e0ef7663d0d0e4292242f84d8368f0cdeefa868c375521

QuasarRAT

2ea29fa9ad61f55762d2d1d3ce608c3fdfe4007802514042552293ce86af0454

QuasarRAT

759650986713eaf7fe5021ead7a0994f33767c14b6a7caf1079379b087df21fe

QuasarRAT

9dfc0d127c1129cd943b1c6ea494a01b40b6b29656db9a44f3dc3231db127a0e

QuasarRAT

d478602bac8b8f334f06644dd92fbe60cbba6815ced96503c7aab4df6f305e77

QuasarRAT

fec56ffb3c5a61bffba235044da127eae17d9772dbd3817b8a5ce8cad0e93cb1

QuasarRAT

+ 78 additional samples on MalwareBazaar

Result

Malware family:

quasar

Score:

10/10

Tags:

trojan spyware family:quasar

Link:

https://tria.ge/reports/201003-t9q2wycnne/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Quasar RAT

Unpacked files

SH256 hash:

e73cf978acde72a0ec094a6fe4302cd7e369624fe183057d01a1c47fd878324f

MD5 hash:

818b88a1598bff8b646a6b46e1fd1d99

SHA1 hash:

38efd87f1abf86c1e83b5b392b7791e8762d5468

Link:

https://www.unpac.me/results/23dca1dc-71be-47af-b877-374954442211/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Quasar

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e73cf978acde72a0ec094a6fe4302cd7e369624fe183057d01a1c47fd878324f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CN_disclosed_20180208_KeyLogger_1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from disclosed CN malware set
Reference:	https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MSILStealer Create hunting rule
Author:	https://github.com/hwvs
Description:	Detects strings from C#/VB Stealers and QuasarRat
Reference:	https://github.com/quasar/QuasarRAT

Rule name:	Quasar Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect QuasarRAT in memory

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_2 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/