MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff2660a00926901eac4025097786a61d7f72816663c6f79089bdd2be49309afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff2660a00926901eac4025097786a61d7f72816663c6f79089bdd2be49309afa
SHA3-384 hash: faafbed432f5916bc5b814187ace5ba02b41e21ce810c37c68a80b05682403314d4a2525822faf2cec219d2ad6c29ac5
SHA1 hash: 90767e6ca1ecae446e6283b3126008f28c7ec8bc
MD5 hash: 4bbbb6049518ce9d84fc37800a5eb289
humanhash: red-mike-cola-failed
File name:FF2660A00926901EAC4025097786A61D7F72816663C6F.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:2'898'944 bytes
First seen:2022-10-16 11:40:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'672 x AgentTesla, 19'494 x Formbook, 12'214 x SnakeKeylogger)
ssdeep 49152:N5nzfQXMgwdwpXA2dcMr+mWwx6re1guuayUfcaza32ehyfTBm:N5n7QXMgwdwNddcMr+mWwx6613ud
Threatray 102 similar samples on MalwareBazaar
TLSH T1C8D56B0877F84E2BE46ED772E5B0406657F0F81AF3A3EB5B6141A6391C53B409D422BB
TrID 53.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
12.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.6% (.SCR) Windows screen saver (13101/52/3)
7.7% (.EXE) Win64 Executable (generic) (10523/12/4)
4.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter abuse_ch
Tags:exe QuasarRAT RAT


Avatar
abuse_ch
QuasarRAT C2:
77.34.128.25:8080

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
77.34.128.25:8080 https://threatfox.abuse.ch/ioc/891454/

Intelligence

File Origin
# of uploads :
1
# of downloads :
426
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/320656/
Detection(s):
Win.Malware.Generic-9883083-0
Create hunting rule

Win.Malware.Msilheracles-9900242-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL
Create hunting rule

Win.Packed.Downeks-6898097-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file
Changing a file
DNS request
Connecting to a non-recommended domain
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm downeks keylogger quasar quasarrat rat stealer
Link:
https://www.filescan.io/uploads/634bedd0898b0652a4b81881/reports/b4490836-5784-4423-ba90-0d659f5d3515/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a94d017-0fc5-46a2-a967-369de45fffc0
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1091379
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Snort IDS alert for network traffic
Yara detected Generic Downloader
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
quasar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ff2660a00926901eac4025097786a61d7f72816663c6f79089bdd2be49309afa/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2022-10-07 00:03:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74tgbiaje2ib5lcaeuexpbvgdv7xfalgmpdppeejxxjl4sjqtl5a._file
Verdict:
malicious
Similar samples:
00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25
QuasarRAT
0b84e664c8b592aa0220d52841629b2accb41f1f624720331000ab5f2f0ed628
QuasarRAT
1d0e8150809cb78fb1cf2cad89dc63b884ef4459e93ce4fbb4676ff705bb2679
QuasarRAT
28d0ac2b1be7545097b6594c9fa467345214473dc91ea83b245735894e47cb61
QuasarRAT
58ed54c59f857cd80bcf4e49b164b812663ae6dce30c39dfde96e5fb69bd7e39
QuasarRAT
cdc6aef29d300c937b80abade4022803e565f3895b697dbcddc11fe36e19d0f5
QuasarRAT
cfba9dab9282455d194d30dad7eac6cfc5c8e5d6caf94d631ed2b01a86e3a97f
QuasarRAT
+ 92 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:965 spyware trojan
Link:
https://tria.ge/reports/221016-nte7jahdep/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Looks up external IP address via web service
Executes dropped EXE
Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
zayprostofyrim.zapto.org:8080
Gathering data
Unpacked files
SH256 hash:
ff2660a00926901eac4025097786a61d7f72816663c6f79089bdd2be49309afa
MD5 hash:
4bbbb6049518ce9d84fc37800a5eb289
SHA1 hash:
90767e6ca1ecae446e6283b3126008f28c7ec8bc
Detections:
QuasarRAT
Create hunting rule
Link:
https://www.unpac.me/results/9deb2f2e-cf2b-45a7-8e33-caca7a697272/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff2660a00926901eac4025097786a61d7f72816663c6f79089bdd2be49309afa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:MALWARE_Win_QuasarStealer
Create hunting rule
Author:ditekshen
Description:Detects Quasar infostealer
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/320656/

Comments