MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
SHA3-384 hash: b570ea1cd3965bc0083fd1f32f025a80429dc6474f9b0f8dfae289411f42ad5401dc1cb1bb9f86b1c1d839e026bebabf
SHA1 hash: 0b03c5b5a8991eeee426bbc85cd3d91b53f76ed1
MD5 hash: 16fbbb3402f4546c544d3eab8c030524
humanhash: triple-table-december-foxtrot
File name:16fbbb3402f4546c544d3eab8c030524.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'853'440 bytes
First seen:2025-07-14 05:27:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 49152:gWPYt89P76xlhM+n4UR3CF2Qgr3X4WTm7:DILLn483Cdgr3XRTm
TLSH T159853312D15546BAEF73D9F6BAF2DDD3A7468A034731A101EC3E12D874531816BEE328
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
16fbbb3402f4546c544d3eab8c030524.exe
Verdict:
Malicious activity
Analysis date:
2025-07-14 05:30:42 UTC
Tags:
evasion crypto-regex
Link:
https://app.any.run/tasks/4304c5b4-4084-47ee-aaf7-e570b08bf30a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14156/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68749571900df8e7f86a8037
Tags:
virus msil remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bladabindi packed zilla
Link:
https://www.filescan.io/uploads/68749567a15b22faa8b0af46/reports/41fd0772-b535-4421-b4ad-9898ea85044d/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a6c22f22-30d9-4c4d-b8d3-26a7330d5918
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1735642
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.14 Win 32 Exe x86
Link:
https://app.malva.re/file/16fbbb3402f4546c544d3eab8c030524
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2/
Verdict:
Malicious
Threat:
ByteCode-MSIL.Trojan.Zilla
Link:
https://tip.neiki.dev/file/9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2025-07-10 14:09:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 38 (73.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=samso3hvbnpihf5ajsa6ox5pguyi6loxwsanxgqgbyofbztgpdza._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
error
QuasarRAT
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250714-f5195shp5x/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ba131ea2-d849-4299-a22c-a63d8fa19566
Unpacked files
SH256 hash:
9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
MD5 hash:
16fbbb3402f4546c544d3eab8c030524
SHA1 hash:
0b03c5b5a8991eeee426bbc85cd3d91b53f76ed1
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
SH256 hash:
6185d78b8a0cade9e6a7eeb728d4194d8d60b30275827fef2f3842e9e4508676
MD5 hash:
f2e9a3062b992c95e02bdfcd77f1f8a6
SHA1 hash:
12cee4da129fe7056ddf1e58e026e2a2de754f45
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
HKTL_NET_GUID_Quasar
Create hunting rule
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
Parent samples :
6ce2462286dc687b1ccab7592a3a68c0504b2639e28cfb8a849e0cd12763fea0
4da64245a16f4a93f5d7d3762addc79a0b997fae82a9cb1dc11fec12334bccff
9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2
3ddbcff678c3056b7ed840e1bff73c75856af1b3b29f7c49c218109cf7aff7d8
4d99b92df452a113bafe2af82d237225ff93afe39fae138305b8201b179357c1
45b69051833ba880b6a9cdededab6249034c7b469dc2be4a5540760250f2f107
5c4c1acbf68da3339d49b855aff31b564faadfaa93fb923fc0ac88ccf2afdea9
c69f207f155799c56a2c5894e1ac532803b5308ada2711090b1f7d6c3cde1e54
SH256 hash:
a14f099682c0382779d37f90e27119036c0d6afc6bc77cf4324cd0956d37bacb
MD5 hash:
46a4172792449b3c386cb5c3a7f7b306
SHA1 hash:
18ff83c492a40668549bbb8effee7ea15aad5b03
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
SH256 hash:
a763566cfa10da2121df0d0759783ee300757859caffc2a3967a24df6a2bf10c
MD5 hash:
f39309b285b76d73d8a0e8c61a804102
SHA1 hash:
2abbfb433c3893753f21bb2942e45e76cb96f71a
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
SH256 hash:
4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 hash:
50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 hash:
3e296ec3bb24750833ea80515e6fb4c73874c91a
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
SH256 hash:
1536144d94f603652ffc602433d4b1851218a816c26ec7311b6baa45d1321205
MD5 hash:
ead8e0d4e1442a26b456016b01b762bf
SHA1 hash:
e0d130cb8ef7ed5270a2a7fd9c761262cf3d9e69
Detections:
INDICATOR_EXE_Packed_Fody
Create hunting rule
Link:
https://www.unpac.me/results/615c3de9-cc07-4831-94d1-0507330938cc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9019276cf50b5e8397a04c81e75faf35308f2dd7b480db9a060e1c50e66678f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/14156/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments