MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
SHA3-384 hash: e86156ef28fb6b884b88ce3cbcaed1e7b34e616299aa6a3d078ecad7cee3eebe9e942fa3aa0c77c7721a95b77d15e607
SHA1 hash: 4f81d9431c3f28f61cd992845167f0c08bef29c7
MD5 hash: 81be32b31cd7f7beb7021e76fe318faa
humanhash: oklahoma-magnesium-bulldog-texas
File name:81be32b31cd7f7beb7021e76fe318faa.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'853'440 bytes
First seen:2025-07-07 13:17:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 49152:LFVne7/OaBQJgbu2yOUaZow653HhXda9emJL+N5G:LPnsPBQJMu2LUaZk3H1UBJyb
Threatray 56 similar samples on MalwareBazaar
TLSH T15E8533B2E6A44D2DF7C7CDB39AA29EC29A0124C37E08E2A5D96F63C2D4425437D4F354
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0.exe
Verdict:
Malicious activity
Analysis date:
2025-07-07 13:31:26 UTC
Tags:
crypto-regex
Link:
https://app.any.run/tasks/9bea05b3-6f00-443d-910b-722939ad4562

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12680/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686bc8ebc9eb974737676420
Tags:
virus msil remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/39786705-6e2f-4f9f-afff-addbb1532b89
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1730091
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs new ROOT certificates
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.14 Win 32 Exe x86
Link:
https://app.malva.re/file/81be32b31cd7f7beb7021e76fe318faa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0/
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2025-07-04 11:27:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntremiug3ruhwhgkw5msuotiybiewjrz4kgpxcuetygncj3d72qa._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
0065d42e62b532221d6ec96913cdedd45d3e84b1d50076b478a5d0a22608b536
QuasarRAT
4a5598e056a1f35b8638a606f9870ad2f05f00bd38076e5cf66fc99cb6309b19
QuasarRAT
6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
QuasarRAT
941c4c116f4b9bd1963f0cdbb39a35b4208f964de9e4214a616581ee00a91f40
QuasarRAT
c7cfa4eb2cce54eae7d5af7025931c424e48c3dd28dcdb76399e4ab23a4c1f6e
QuasarRAT
error
QuasarRAT
f5a8c8e7ae8328c7fc396423188c153fc6a9cfce132b1a5bb288086110fccfc7
QuasarRAT
+ 46 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250707-qj37qaaq9z/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a90ec28d-d0e8-41e4-90aa-114fa08f1521
Unpacked files
SH256 hash:
6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
MD5 hash:
81be32b31cd7f7beb7021e76fe318faa
SHA1 hash:
4f81d9431c3f28f61cd992845167f0c08bef29c7
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
SH256 hash:
6185d78b8a0cade9e6a7eeb728d4194d8d60b30275827fef2f3842e9e4508676
MD5 hash:
f2e9a3062b992c95e02bdfcd77f1f8a6
SHA1 hash:
12cee4da129fe7056ddf1e58e026e2a2de754f45
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
HKTL_NET_GUID_Quasar
Create hunting rule
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
Parent samples :
6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
4da64245a16f4a93f5d7d3762addc79a0b997fae82a9cb1dc11fec12334bccff
9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
3ddbcff678c3056b7ed840e1bff73c75856af1b3b29f7c49c218109cf7aff7d8
4d99b92df452a113bafe2af82d237225ff93afe39fae138305b8201b179357c1
45b69051833ba880b6a9cdededab6249034c7b469dc2be4a5540760250f2f107
5c4c1acbf68da3339d49b855aff31b564faadfaa93fb923fc0ac88ccf2afdea9
c69f207f155799c56a2c5894e1ac532803b5308ada2711090b1f7d6c3cde1e54
SH256 hash:
b89d36e33a4deace914af285a8f1f97d4f3855a9a4e909d1ea82c51f2d430e6e
MD5 hash:
7cfe9211e9d5277971ed4418ddf61357
SHA1 hash:
2abc069249a7e1fba8628fdb9252e7fd0d5bbd17
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
SH256 hash:
ae844317eafa2a2d481e469f2729d9d8eac92f0f851924389e4f9b01823abc7d
MD5 hash:
ce5f04873c660f9c5c4a26bf8541c0d5
SHA1 hash:
4f0f9a23f9aadd4cd0935801c31959100be4538e
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
SH256 hash:
610cbb73ca15b9322a9279bbe4e997e749126e291622fe563953a033ed380cb5
MD5 hash:
32121e7e8fb72557554f30755ced9258
SHA1 hash:
a95757c9b47dd193fd7fbcf80bd5062763be642e
Detections:
INDICATOR_EXE_Packed_Fody
Create hunting rule
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
SH256 hash:
5012d7cab74e4d5bd9fdd298d05ae5d51442e66d426e5859beb9a513ad1acae4
MD5 hash:
79331ea5a83291a3f45014f126c5176f
SHA1 hash:
d60daf9acaacbeb3def349c76f236df1460a4797
Link:
https://www.unpac.me/results/a2bb9650-d239-4a9e-8a85-09036cd65581/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12680/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments