MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23
SHA3-384 hash: a49aa58b1b2e217217558e1a14c0467b888622090aa226bc3c29469e245b2dfab8c8b36b273f9f0f96f7e37e208dfd9e
SHA1 hash: 4a87a29dee20f67e8cf126e0d7e1e91afee19090
MD5 hash: fae5f90628f1b10186d40f354a848132
humanhash: monkey-august-georgia-batman
File name:helloword.ps1
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:2'184 bytes
First seen:2025-06-04 13:15:47 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:0HbZ43oGGoimb7O0ZVHZf6MfQAZzDC8o4fOK5ZY:07Z43oG/RZvfQAZzDC8tOKE
Threatray 637 similar samples on MalwareBazaar
TLSH T1DE41772553266B324A7249536F0ED0ECFE239138136A0810F470C02CEDBE45982AFBBF
Magika powershell
Reporter abuse_ch
Tags:ps1 QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.BZC.PZQ.Boxter.826.DD43D1E5.5523.10400.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=684047c18bd5d68a12e52250
Tags:
virus sage remo
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/68404732171e01f95935d3d9/reports/e62ab404-9c4b-40f3-a813-bc17c476a58b/overview
Verdict:
Malicious
Labled as:
BZC.PZQ.Boxter.826
Link:
https://www.hybrid-analysis.com/sample/7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1705948
Signature
Antivirus detection for dropped file
Found malware configuration
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1705948 Sample: helloword.ps1 Startdate: 04/06/2025 Architecture: WINDOWS Score: 92 23 raw.githubusercontent.com 2->23 27 Found malware configuration 2->27 29 Malicious sample detected (through community Yara rule) 2->29 31 Antivirus detection for dropped file 2->31 33 5 other signatures 2->33 8 powershell.exe 15 28 2->8         started        signatures3 process4 dnsIp5 25 raw.githubusercontent.com 185.199.111.133, 443, 49720 FASTLYUS Netherlands 8->25 19 C:\Users\user\AppData\...\nprzydgi.cmdline, Unicode 8->19 dropped 12 csc.exe 3 8->12         started        15 conhost.exe 8->15         started        file6 process7 file8 21 C:\Users\user\AppData\Local\...\nprzydgi.dll, PE32 12->21 dropped 17 cvtres.exe 1 12->17         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23/
Threat name:
Win32.Dropper.Boxter
Create hunting rule
Status:
Malicious
First seen:
2025-06-03 21:52:45 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 24 (25.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvzz44jdgxzjjt3ejwev23jeozxg6rn26tgbpaszuulvzwvq5qrq._file
Verdict:
malicious
Label(s):
venomrat
Create hunting rule
donut_injector
Create hunting rule
Similar samples:
31f0e68a0fb8a6e1714ade7379d486d56aa1421d2f22ff3d632c1fe24f59457a
QuasarRAT
39d8d782ab9d2c91b4816543515a5f3a366682a09f3edabe6e657e327d405699
QuasarRAT
4b8b03e7573fcbe521e0ffa7952e7548ade8f6221bdb19b2a8d3a9473cef4417
QuasarRAT
8ad7d50075f254b758085711870af8f7172346526662fd1174e48355f776a119
QuasarRAT
e80f3c203f63b88dfe4569fcb0e7ba3c46e1c439eaebe6c5beadf76ac282daeb
QuasarRAT
error
QuasarRAT
+ 627 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:quasar botnet:negrosis execution loader spyware trojan
Link:
https://tria.ge/reports/250604-qhzsxaysdw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Blocklisted process makes network request
Detects DonutLoader
DonutLoader
Donutloader family
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
go-dramatically.gl.at.ply.gg:2676
Dropper Extraction:
https://raw.githubusercontent.com/XeroxzB/weqeq/main/1update.bin
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

PowerShell (PS) ps1 7d739e712335f294cf644d895d6d24766e6f45baf4cc178259a5175cdab0ec23

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3557669/
  
Delivery method
Distributed via web download

Comments