MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f45e57908a7d464f45087124783a19070fe54038c5b009637eca3e89d2bcc9b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XFilesStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	f45e57908a7d464f45087124783a19070fe54038c5b009637eca3e89d2bcc9b1
SHA3-384 hash:	4e0a34cbe8f2f842d921a56775d01331fea71a590fcd8cb28e4f1b1ddec3957577fc5bbc37b69de496ef20c10fccf514
SHA1 hash:	8059287b71286ebdefa8dac00587fc2af20be188
MD5 hash:	d6f10f71c9cbbb9eeb2c6c6794dafd17
humanhash:	moon-fillet-mississippi-beryllium
File name:	d6f10f71c9cbbb9eeb2c6c6794dafd17.exe
Download:	download sample
Signature	XFilesStealer Create hunting rule
File size:	514'048 bytes
First seen:	2022-07-26 16:08:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:RTEgdc0YrX7IxUpGREWXkYoQdTEDXKpDkQfocEPOb8F9XpfXfNLQcTR3x:RTEgdfYIxUIA+Dk/ptp3NLQcdx
TLSH	T166B46C4063F8862BE1AF577AE871042597F4F407B2ABEF4F4A40A1F92D66706AD40773
TrID	53.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 12.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.6% (.SCR) Windows screen saver (13101/52/3) 7.7% (.EXE) Win64 Executable (generic) (10523/12/4) 4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter	abuse_ch
Tags:	exe XFilesStealer

Intelligence

File Origin

# of uploads :

# of downloads :

420

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/294415/

Detection(s):

Win.Malware.Bulz-9823462-0

Win.Malware.Generic-9883082-0

Win.Malware.Generic-9883083-0

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Win.Packed.Downeks-6898097-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Changing a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm greyware keylogger packed quasarrat rat shell32.dll stealer vermin

Link:

https://www.filescan.io/uploads/62e011927dd0cb902f01596d/reports/b2bd6573-005f-451d-9803-13ee5ef20513/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ca69815b-b579-4ee6-adf1-3876ac2b60c2

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1041227

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

quasar

Link:

https://mwdb.cert.pl/sample/f45e57908a7d464f45087124783a19070fe54038c5b009637eca3e89d2bcc9b1/

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2022-07-26 04:30:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6rpfpeekpvde6riioeshqoqza4h6kqbyywyasy36zi7ituv4zgyq._file

Verdict:

malicious

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:office04 spyware trojan

Link:

https://tria.ge/reports/220726-tlsesaefa6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates physical storage devices

Quasar RAT

Quasar payload

Malware Config

C2 Extraction:

127.0.0.1:4782

Unpacked files

SH256 hash:

f45e57908a7d464f45087124783a19070fe54038c5b009637eca3e89d2bcc9b1

MD5 hash:

d6f10f71c9cbbb9eeb2c6c6794dafd17

SHA1 hash:

8059287b71286ebdefa8dac00587fc2af20be188

Link:

https://www.unpac.me/results/3358a885-924a-41a9-985e-078536acf3e4/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	MALWARE_Win_QuasarStealer Create hunting rule
Author:	ditekshen
Description:	Detects Quasar infostealer

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MAL_QuasarRAT_May19_1_RID2E1E Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Vermin_Keylogger_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Vermin Keylogger
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/