MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb9f9715d52a62ee8337f5fd19c370b927c266ae1166eb571117e85f66216343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 13

Intelligence 13 IOCs YARA 8 File information Comments 1

SHA256 hash:	eb9f9715d52a62ee8337f5fd19c370b927c266ae1166eb571117e85f66216343
SHA3-384 hash:	e5dd2f2ca6fd2db95669e17dffe6b89d9f3521fa51fe2a2fc3486133474eda4e66d9c2d29fad24109620641d74aaa386
SHA1 hash:	6c523affaa0d837a1c0c557f499bf975a3141891
MD5 hash:	327969943748e3177d44ef00dfe63491
humanhash:	maryland-pip-undress-summer
File name:	327969943748e3177d44ef00dfe63491
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	10'606'080 bytes
First seen:	2022-07-20 19:27:54 UTC
Last seen:	2022-07-22 10:44:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	196608:cZKsavnxlGZ6TgWbI41DFccp0a9QahD5tC/k/93S7o7Fv:uKsavXpTgWbI41DaFcHYk/93S0hv
TLSH	T1ABB6330777D8D737C4BE9733E43A42214FB1A412B62AD38A6A9580797E367494E903F3
TrID	59.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 13.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.6% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	zbetcheckin
Tags:	32 exe QuasarRAT

Intelligence

File Origin

# of uploads :

# of downloads :

335

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QuasarRAT

Link:

https://www.capesandbox.com/analysis/292997/

Detection(s):

Win.Packed.Generic-9829635-0

Win.Packed.Generic-9830106-0

Win.Trojan.Generic-6295765-0

Win.Malware.Generic-6623004-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Setting a keyboard event handler

Creating a file in the %AppData% subdirectories

Creating a window

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm fingerprint greyware keylogger packed quasar rat shell32.dll stealer stealer

Link:

https://www.filescan.io/uploads/62d857ca0e298a94f3e456a2/reports/a095aa80-1b46-429e-9c34-4c51307a3ee2/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Quasar RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/608c7e89-2c50-43dc-a3f6-eeee9898b107

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1037891

Behaviour

Behavior Graph:

n/a

Detection:

quasar

Link:

https://mwdb.cert.pl/sample/eb9f9715d52a62ee8337f5fd19c370b927c266ae1166eb571117e85f66216343/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2022-07-20 19:28:12 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5opzofovfjro5azx6x6rtq3qxet4ezvocftowvyrc7uf6zrbmnbq._file

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:on1 portrait ai 2022.5 spyware trojan

Link:

https://tria.ge/reports/220720-x6m8caged2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Looks up external IP address via web service

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

manecraft.giize.com:1980

Unpacked files

SH256 hash:

eb9f9715d52a62ee8337f5fd19c370b927c266ae1166eb571117e85f66216343

MD5 hash:

327969943748e3177d44ef00dfe63491

SHA1 hash:

6c523affaa0d837a1c0c557f499bf975a3141891

Link:

https://www.unpac.me/results/d5fbb6de-ce08-4924-9463-16a3ccd47977/

Malware family:

xRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eb9f9715d52a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eb9f9715d52a62ee8337f5fd19c370b927c266ae1166eb571117e85f66216343

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	malware_Quasar_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect QuasarRAT in memory

Rule name:	MALWARE_Win_QuasarRAT Create hunting rule
Author:	ditekSHen
Description:	QuasarRAT payload

Rule name:	pe_imphash Create hunting rule

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_1_RID2B54 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf