MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea
SHA3-384 hash: bf901d444caaa9b2ffdf8ba709e25c54959b38b1ccba6f4766fcc88e32ce7dfd128e8ad52b62a8b75d1d23a1e213ffd7
SHA1 hash: 195c23e37d4d293b7b70dacb95a76828de3134d0
MD5 hash: b5e5b0e5a13586f3bb601711aa15e41f
humanhash: north-virginia-pizza-wisconsin
File name:Quote_PDF.vbs
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:2'795'474 bytes
First seen:2022-04-12 11:54:21 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 49152:Xcq7Do1hLo7a1Az5mR17eUD/565MDjt/W:l
Threatray 1'136 similar samples on MalwareBazaar
TLSH T1DED5DF7292A3FCCF6B7F0D44A9142C638C841D5B83A14258FAC527EDA5DBC10EF694B6
Reporter abuse_ch
Tags:QuasarRAT RAT Telegram vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/263016/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.Base64EXE-2.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/625568a1ffe27d5119b51f8a/reports/0b12fd4a-0ac7-4b27-bbdd-b3dc7aa0af87/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
AgentTesla Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/975300
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Benign windows process drops PE files
Contains functionality to register a low level keyboard hook
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Quasar RAT
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 607785 Sample: Quote_PDF.vbs Startdate: 12/04/2022 Architecture: WINDOWS Score: 100 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 Multi AV Scanner detection for submitted file 2->75 77 10 other signatures 2->77 8 wscript.exe 3 2->8         started        12 hmltog.exe 2->12         started        14 hmltog.exe 2->14         started        process3 file4 45 C:\Users\user\AppData\Local\Temp\office.exe, PE32 8->45 dropped 47 C:\Users\user\AppData\Local\Temp\home.exe, PE32 8->47 dropped 79 Benign windows process drops PE files 8->79 16 home.exe 3 8->16         started        19 office.exe 6 8->19         started        22 conhost.exe 12->22         started        24 conhost.exe 14->24         started        signatures5 process6 file7 59 Machine Learning detection for dropped file 16->59 61 Writes to foreign memory regions 16->61 63 Injects a PE file into a foreign processes 16->63 26 RegSvcs.exe 16->26         started        41 C:\Users\user\AppData\...\LQwyiAfGAle.exe, PE32 19->41 dropped 43 C:\Users\user\AppData\Local\...\tmpC08B.tmp, XML 19->43 dropped 65 May check the online IP address of the machine 19->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 19->67 69 Adds a directory exclusion to Windows Defender 19->69 31 office.exe 19->31         started        33 powershell.exe 25 19->33         started        35 schtasks.exe 19->35         started        signatures8 process9 dnsIp10 51 api.telegram.org 149.154.167.220, 443, 49850, 49851 TELEGRAMRU United Kingdom 26->51 49 C:\Users\user\AppData\Roaming\...\hmltog.exe, PE32 26->49 dropped 81 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->81 83 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 26->83 85 Tries to steal Mail credentials (via file / registry access) 26->85 91 4 other signatures 26->91 53 ip-api.com 208.95.112.1, 49732, 80 TUT-ASUS United States 31->53 55 216.250.250.94, 4788, 49733, 49735 AS-TIERP-19019US United States 31->55 57 192.168.2.1 unknown unknown 31->57 87 Hides that the sample has been downloaded from the Internet (zone.identifier) 31->87 89 Installs a global keyboard hook 31->89 37 conhost.exe 33->37         started        39 conhost.exe 35->39         started        file11 signatures12 process13
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 11:55:07 UTC
File Type:
Text (VBS)
AV detection:
13 of 26 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kbtgfofth4g3grpdubavzuphezjzc2diany4a7ozsrsyw7qctva._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01526b381acd09438b74ca04eacf96cdc8f8fdafb36e85be9a099223db630f72
QuasarRAT
4d9f9ebfea637dfcd6415af650b54f8930d38c3b93192164cddd59e64ce86e74
QuasarRAT
5c395df95b067f10c115f92e193d7f61bc6ce05eefb20bfc86aac86f278e0600
QuasarRAT
672d98cad4d5aab1bea0ab262b4f154bb877844a61e742416ac73ed723f1cb99
QuasarRAT
7431f9ba6aec04eac9673c804378df129f167a06927649ec7aca9872fb15f14b
QuasarRAT
a98fb020ed1b1b79495423933331d152b65d0db7947e403bdebe41f999540e6d
QuasarRAT
b6e510ac38643fbc455d38144a8ab0990056379c596c5728987d062fa3a64efc
QuasarRAT
c2f70806a9fddb3ff61f045c92c48a19a0f889b839f68a2acd0e71e6c091499c
QuasarRAT
c76303ad32caa1dc46b93eadd1de1342a67001559c2be9ab42e50b4615c71baa
QuasarRAT
+ 1'126 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:quasar botnet:office04 collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220412-n3g3gsbcej/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
AgentTesla
Quasar Payload
Quasar RAT
Malware Config
C2 Extraction:
https://api.telegram.org/bot5127674234:AAHGscjRk7JCDDCItFO4GPZfan-K7Hc89Z8/sendDocument
216.250.250.94:4788
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/f2833315c599/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:CN_disclosed_20180208_KeyLogger_1
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:CN_disclosed_20180208_KeyLogger_1_RID3227
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:malware_Quasar_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_QuasarRAT
Create hunting rule
Author:ditekSHen
Description:QuasarRAT payload
Rule name:MAL_Lokibot_Stealer
Create hunting rule
Description:Detects Lokibot Stealer Variants
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_1_RID2B54
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2_RID2B55
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Vermin_Keylogger_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects Vermin Keylogger
Reference:https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:xRAT_1
Create hunting rule
Author:Florian Roth
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W
Rule name:xRAT_1_RID2900
Create hunting rule
Author:Florian Roth
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

Visual Basic Script (vbs) vbs f2833315c599f86d9a2f1d020ae68f39329c8b43401b8e03eecca32c5bf014ea

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/263016/

Comments