MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efee0bad940d7c171c90d679fda01d48a3471e8a170dc1b747d9ad2c1a6f7c3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efee0bad940d7c171c90d679fda01d48a3471e8a170dc1b747d9ad2c1a6f7c3d
SHA3-384 hash: 8703cbab1b2d32f896ee4c054735a377565feb3ff9fae60f1603c1f7ab787127a31dd535d564510a798a17df0defd1c1
SHA1 hash: 304efbbd8db4d873295b42476da40ff82afdbd86
MD5 hash: 0b8ef09ab833fc06a01e832ea490fc5f
humanhash: golf-comet-burger-comet
File name:VN55.ISO
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:53'248 bytes
First seen:2021-01-12 06:20:13 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24:5r35l50nei535l5+RAPAQrk39pFctxftoAAIdIAe1eGVqdd:5r35l50nv535l5+RAP7cFcvGRASLVqd
TLSH DA3308136E854499C9249634D6B67DAC4A27B08927F37217F54DC5A4078FFC88A3A3E2
Reporter abuse_ch
Tags:iso QuasarRAT RAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: vps-3d9c4a22.vps.ovh.net
Sending IP: 51.68.214.238
From: WebBill <BillShop-id2535548@domain.com>
Subject: your order has been placed##253554
Attachment: VN55.ISO (contains "VN55.vbs")

QuasarRAT payload URL:
https://z.zz.ht/nlOiE.jpg

QuasarRAT C2:
sdffgre.myq-see.com:9999 (51.89.204.178)

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ISB.Downloadergen48.3022.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/efee0bad940d7c171c90d679fda01d48a3471e8a170dc1b747d9ad2c1a6f7c3d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-12 06:21:07 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=57xaxlmubv6boheq2z473ia5jcruohukc4g4dn2h3gwsygtppq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/efee0bad940d7c171c90d679fda01d48a3471e8a170dc1b747d9ad2c1a6f7c3d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

iso efee0bad940d7c171c90d679fda01d48a3471e8a170dc1b747d9ad2c1a6f7c3d

(this sample)

QuasarRAT

Visual Basic Script (vbs) vbs 36baf9c7d6ed1aa739eb8bf2d3ad8eccc5419a6edd780b0738e2e33d55d9fe94

  
URLhaus
https://urlhaus.abuse.ch/url/954554/
  
Dropping
MD5 fabfa16d992fc7550171b117fa52d804
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36baf9c7d6ed1aa739eb8bf2d3ad8eccc5419a6edd780b0738e2e33d55d9fe94

Comments