MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f8b6eddbe3fd90f45c93cfdaf71fe200371518c6f0c100e2aad9f193d7260c05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
QuasarRAT
Vendor detections: 16
| SHA256 hash: | f8b6eddbe3fd90f45c93cfdaf71fe200371518c6f0c100e2aad9f193d7260c05 |
|---|---|
| SHA3-384 hash: | 8cc67a343fa07d15abf33d802d4a5f25d1e2e43dfd377d9f4329f27d4df257b8ae04795c47fffd4dea047bd058525df8 |
| SHA1 hash: | 13382965ec47a60dcf07aeadd7414f215099f564 |
| MD5 hash: | cc38554b00499e85149b2c1c0a22473e |
| humanhash: | alanine-spaghetti-dakota-utah |
| File name: | Adobe Download Manager.exe |
| Download: | download sample |
| Signature | QuasarRAT |
| File size: | 2'112'856 bytes |
| First seen: | 2023-12-22 20:18:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT) |
| ssdeep | 24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYP:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YB |
| TLSH | T1B1A5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353 |
| TrID | 52.1% (.OCX) Windows ActiveX control (116521/4/18) 25.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 7.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) |
| File icon (PE): |  |
| dhash icon | d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook) |
| Reporter |  adm1n_usa32 |
| Tags: | exe QuasarRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
303
Origin country :
ROVendor Threat Intelligence
Detection:
QuasarRAT
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug anti-vm autoit carberp control crypto evasive eventvwr explorer fingerprint greyware hook infostealer keylogger keylogger lolbin lolbin miner overlay packed quasar quasarrat rat schtasks shell32 stealer stealer ursnif vermin xrat
Verdict:
Malicious
Labled as:
Trojan.Generic
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DarkVNC
Verdict:
Malicious
Result
Threat name:
AZORult, Quasar, Ramnit
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Contains VNC / remote desktop functionality (version string found)
Detected AZORult Info Stealer
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Azorult
Yara detected Azorult Info Stealer
Yara detected Generic Downloader
Yara detected Quasar RAT
Yara detected Ramnit VNC Module
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Detection:
quasar
Threat name:
Win32.Trojan.MoksSteal
Status:
Malicious
First seen:
2023-12-21 15:07:00 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
31 of 37 (83.78%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
azorult
Result
Malware family:
quasar
Score:
10/10
Tags:
family:azorult family:quasar botnet:ebayprofiles infostealer spyware trojan
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
AutoIT Executable
Suspicious use of SetThreadContext
Maps connected drives based on registry
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Azorult
Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
5.8.88.191:443
sockartek.icu:443
http://0x21.in:8000/_az/
sockartek.icu:443
http://0x21.in:8000/_az/
Unpacked files
SH256 hash:
f8b6eddbe3fd90f45c93cfdaf71fe200371518c6f0c100e2aad9f193d7260c05
MD5 hash:
cc38554b00499e85149b2c1c0a22473e
SHA1 hash:
13382965ec47a60dcf07aeadd7414f215099f564
Detections:
QuasarRAT
malware_windows_xrat_quasarrat
AutoIT_Compiled
cn_utf8_windows_terminal
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Quasar_RAT_2
Quasar
MAL_QuasarRAT_May19_1
MALWARE_Win_QuasarRAT
SUSP_Imphash_Mar23_3
INDICATOR_SUSPICIOUS_GENInfoStealer
Quasar_RAT_1
win_quasarrat_j1
Malware family:
QuasarRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.