MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f50557dca4c312d9794ba3835b70e2062a0c0103bb01a309dc48572e2ece4da8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f50557dca4c312d9794ba3835b70e2062a0c0103bb01a309dc48572e2ece4da8
SHA3-384 hash: f38823dde6032345368b6c929dd097488a560d444191fa0d8d83f9c4b4dd92bb458f7024a03fb7a28aef89fe00ae6ec8
SHA1 hash: 9f8ea08e322c9830e2d73c53edb0fb3ad515bb1d
MD5 hash: 7bca97664238a794e036c6838fbf01a0
humanhash: sweet-texas-don-uranus
File name:PAGO.EXE
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'836'316 bytes
First seen:2022-07-11 10:34:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:YhvJVJdM4rXzIlQBLv8WoQN/2BAICiiBmgXu3nOVXf8dRtu9h:A3dx46N9o+oAciBnXonu0bt4h
TLSH T11485BE56B813CCFED17F46F4241C39749A11BD74A91B286E23EBB94583B8690F5233E2
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b064646aeed6e6ee (5 x AgentTesla, 1 x QuasarRAT)
Reporter pr0xylife
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
243
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
PAGO.EXE
Verdict:
Malicious activity
Analysis date:
2022-07-11 19:30:04 UTC
Tags:
evasion trojan quasar
Link:
https://app.any.run/tasks/1bc2e1fb-fbc4-4657-83cf-85c94bc618f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/286168/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37098799.28291.25939.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% directory
Running batch commands
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Launching a process
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/25037/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/62cbfd17a496df53c2516941/reports/5c445092-d1a0-49b4-ae48-143c091acb0d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8026e721-f6f2-44ef-9da5-95b971357d67
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1028442
Signature
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has nameless sections
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 660939 Sample: PAGO.EXE Startdate: 11/07/2022 Architecture: WINDOWS Score: 100 89 Snort IDS alert for network traffic 2->89 91 Malicious sample detected (through community Yara rule) 2->91 93 Yara detected Quasar RAT 2->93 95 6 other signatures 2->95 13 PAGO.EXE 3 9 2->13         started        16 sver1.exe 2->16         started        19 sver1.exe 2->19         started        21 sver1.exe 2->21         started        process3 file4 67 C:\Users\user\AppData\Roaming\sver1.sfx.exe, PE32 13->67 dropped 23 cmd.exe 1 13->23         started        25 AcroRd32.exe 39 13->25         started        77 Injects a PE file into a foreign processes 16->77 28 sver1.exe 16->28         started        30 sver1.exe 19->30         started        signatures5 process6 dnsIp7 32 sver1.sfx.exe 7 23->32         started        36 conhost.exe 23->36         started        73 192.168.2.1 unknown unknown 25->73 38 RdrCEF.exe 76 25->38         started        process8 file9 63 C:\Users\user\AppData\Roaming\sver1.exe, PE32 32->63 dropped 87 Multi AV Scanner detection for dropped file 32->87 40 sver1.exe 1 32->40         started        signatures10 process11 signatures12 99 Detected unpacking (changes PE section rights) 40->99 101 May check the online IP address of the machine 40->101 103 Machine Learning detection for dropped file 40->103 105 2 other signatures 40->105 43 sver1.exe 16 4 40->43         started        process13 dnsIp14 75 ip-api.com 208.95.112.1, 49768, 49844, 80 TUT-ASUS United States 43->75 65 C:\Users\user\AppData\Roaming\ilio\idn.exe, PE32 43->65 dropped 107 Hides that the sample has been downloaded from the Internet (zone.identifier) 43->107 48 idn.exe 43->48         started        51 schtasks.exe 43->51         started        file15 signatures16 process17 signatures18 79 Detected unpacking (changes PE section rights) 48->79 81 May check the online IP address of the machine 48->81 83 Machine Learning detection for dropped file 48->83 85 Injects a PE file into a foreign processes 48->85 53 idn.exe 48->53         started        57 conhost.exe 51->57         started        process19 dnsIp20 69 dnuocc.com 37.0.8.180, 49846, 64592 WKD-ASIE Netherlands 53->69 71 ip-api.com 53->71 97 Hides that the sample has been downloaded from the Internet (zone.identifier) 53->97 59 schtasks.exe 53->59         started        signatures21 process22 process23 61 conhost.exe 59->61         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f50557dca4c312d9794ba3835b70e2062a0c0103bb01a309dc48572e2ece4da8/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2022-07-11 10:35:10 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ucvpxfeymjns6kluobvw4hcayvayaidxma2gco4jbls4lwojwua._file
Verdict:
malicious
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:qop spyware suricata trojan
Link:
https://tria.ge/reports/220711-mmnpnaafe6/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Quasar RAT
Quasar payload
suricata: ET MALWARE Common RAT Connectivity Check Observed
Malware Config
C2 Extraction:
dnuocc.com:64592
www.dnuocc.com:64592
copresamvom.freedynamicdns.net:64592
Unpacked files
SH256 hash:
0ca50b7f996fbd2185d6aa7a7bf5c3fbf5dda4b648dd20eea7c0c447cc64ecde
MD5 hash:
b52d147ef901e555fbd32965779ab834
SHA1 hash:
813e3775b20b121b7e3877ef8ffa1f590b863c54
Link:
https://www.unpac.me/results/f13ba433-4ce6-465b-b354-23ede400c7fd/
SH256 hash:
8f31dca86233f1c2c409e0fac63f6662e5e287214102043823339d19655880cf
MD5 hash:
99ea2ef4d737b2a91e92e9784da5463d
SHA1 hash:
59009f08f81cbaed5a0fed74e1871b06c2322512
Link:
https://www.unpac.me/results/f13ba433-4ce6-465b-b354-23ede400c7fd/
SH256 hash:
f673546d6b2799ddbff39ad65eb69aad697bcf07ec1d740060596e34ca879fae
MD5 hash:
d8a471b7d32a6ba01c62f46e20e52495
SHA1 hash:
4cd6e4a4da2aab7c851b56afb65cd183d146c7bb
Link:
https://www.unpac.me/results/f13ba433-4ce6-465b-b354-23ede400c7fd/
SH256 hash:
f50557dca4c312d9794ba3835b70e2062a0c0103bb01a309dc48572e2ece4da8
MD5 hash:
7bca97664238a794e036c6838fbf01a0
SHA1 hash:
9f8ea08e322c9830e2d73c53edb0fb3ad515bb1d
Link:
https://www.unpac.me/results/f13ba433-4ce6-465b-b354-23ede400c7fd/
Malware family:
xRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f50557dca4c3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f50557dca4c312d9794ba3835b70e2062a0c0103bb01a309dc48572e2ece4da8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:suspicious_sfx_files_simple_rule
Create hunting rule
Author:Razvan.A.B
Description:Detects suspicious files containing sfx
Rule name:suspicious_sfx_files_size_rule
Create hunting rule
Author:Razvan.A.B
Description:Detects suspicious files containing sfx

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/286168/

Comments