MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8f9e4daabce9c02c3b067fa13c72e8d43d229296eb8e2f96e2ee66baa42ab96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8f9e4daabce9c02c3b067fa13c72e8d43d229296eb8e2f96e2ee66baa42ab96
SHA3-384 hash: 6b598e62e74609277ed7b53983d9f31e8be9bfe573d7e3941a18ca1e93607bba7653d1dc1bcc8ac24800ce340599a1f5
SHA1 hash: a74913bc5f6243730cff6b47d38528c800be371f
MD5 hash: 82dd00e12563ab800fd3e16cc7127bf9
humanhash: steak-network-helium-blue
File name:flashplayerpp_install_cn_fc.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:697'856 bytes
First seen:2021-04-03 14:04:40 UTC
Last seen:2021-04-03 14:45:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash accf64341e6553161426c29ae77d0bf8 (1 x QuasarRAT)
ssdeep 12288:C2U8cqvTBJyTfd2m+WBDNjIEttfNq58+wya/SEkhRH8qdoe:k8B8smJDJxtbivwyaj1qie
TLSH 55E40152B65030F9E2369236CF8226C9E77AB8364B714BDF069A42851F6B1F54C3DE31
Reporter vm001cn
Tags:QuasarRAT RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
长江环保生态系统-胡琳琳-个人简历.exe
Verdict:
Malicious activity
Analysis date:
2021-04-03 13:51:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7fb0a41f-b911-469e-93ad-502665674b19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/131999/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46015803.20098.27465.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/664953
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8f9e4daabce9c02c3b067fa13c72e8d43d229296eb8e2f96e2ee66baa42ab96/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2021-04-02 11:47:54 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Verdict:
unknown
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar spyware trojan
Link:
https://tria.ge/reports/210403-d23cslqa16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Quasar Payload
Quasar RAT
Unpacked files
SH256 hash:
e8f9e4daabce9c02c3b067fa13c72e8d43d229296eb8e2f96e2ee66baa42ab96
MD5 hash:
82dd00e12563ab800fd3e16cc7127bf9
SHA1 hash:
a74913bc5f6243730cff6b47d38528c800be371f
Link:
https://www.unpac.me/results/897445fd-8077-473a-9794-d3889fc7b583/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Quasar
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8f9e4daabce9c02c3b067fa13c72e8d43d229296eb8e2f96e2ee66baa42ab96

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/131999/

Comments