MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8
SHA3-384 hash:	43ac1d4b20b49c6aa7ba3d457d3ef9b9d0c1beb26ee551f8767caf7d088beb11cf3ae8385966d520b8e5c58e0670584b
SHA1 hash:	dce47ad6eb232e1df3b014ad690d3e6233170a9f
MD5 hash:	c5dbdd47d42994efc153c6ec0475fbd7
humanhash:	sink-romeo-oregon-lactose
File name:	558_return.js
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	5'194 bytes
First seen:	2024-03-19 11:43:16 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	96:xvMev69dHo3vYuG2vwVBAxgQMnXeScYA4c19RqkUN6TM4JE0H8KqCr:xkeCTuQuG2KWxfkciqqfEEKz
TLSH	T1BEB14BD27D982B607257DF027AD1B5F28D1EB757E977B2FC6040918813E0C846E05BAB
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Reporter	mossdinger
Tags:	js QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

462

Origin country :

TH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30413.JsHeur.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated powershell

Link:

https://www.filescan.io/uploads/65f97a87c1137bbf149ea20e/reports/eed3934c-007d-42b8-a3be-7c2addebcb26/overview

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Clipboard Hijacker, Quasar

Result

Threat name:

Clipboard Hijacker, Quasar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1411676

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to hide user accounts

Creates autostart registry keys with suspicious values (likely registry only malware)

Found suspicious powershell code related to unpacking or dynamic code loading

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Sigma detected: WScript or CScript Dropper

Snort IDS alert for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected Generic Downloader

Yara detected Powershell download and execute

Yara detected Quasar RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-03-18 03:55:22 UTC

File Type:

Text (Batch)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=52gyjy62hyjtjwxrd3zx27whxyagcqbptxzpwpjtzfu3uhxxptea._file

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:novotrampo2 persistence spyware trojan

Link:

https://tria.ge/reports/240319-nv5tksbb89/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Checks computer location settings

Blocklisted process makes network request

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

54.39.233.85:5552

Dropper Extraction:

https://pt.textbin.net/download/zbbh8tfbo9

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8