MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
SHA3-384 hash: 7040ea1276f411691407c39401bf823e4332a4081908634f39a8eedc4c9821e600c57fc4c32e73d3f61897819ff4288d
SHA1 hash: abc81778e20711075941cd11930be3b38a12f429
MD5 hash: 69f5b19dc9d7675f57de11043992192d
humanhash: tennis-cardinal-lake-bakerloo
File name:c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:24'064 bytes
First seen:2025-09-04 12:51:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c6483cddb066c37c14a239b4fed18651 (2 x DonutLoader, 1 x QuasarRAT)
ssdeep 384:7EY5JpIZ0RYqkTs78jIfW74uhc10iy+5U0me+:QQpH52s78jyA4uhzc5U0E
Threatray 188 similar samples on MalwareBazaar
TLSH T183B2C50FB343A0D8C51BC1788BFA8373B9B1BD1164666B2E57A0D7650F64DAA1E3CB14
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:exe fuckrat-ru github-samninja666 Quasar QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
Verdict:
Malicious activity
Analysis date:
2025-09-04 12:56:37 UTC
Tags:
github uac
Link:
https://app.any.run/tasks/fbff6f92-f0a6-41ca-a3af-b73acb75e063

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/25054/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b98de3eb163e0ec1845549
Tags:
phishing emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a window
Сreating synchronization primitives
Connection attempt to an infection source
Query of malicious DNS domain
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug mingw packed
Link:
https://www.filescan.io/uploads/68b98b996212e2f742692736/reports/bf61404e-e623-4d86-a4f9-fafb49ab6d27/overview
Verdict:
Malicious
Labled as:
Barys.Generic
Link:
https://www.hybrid-analysis.com/sample/c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-04T10:46:00Z UTC
Last seen:
2025-09-04T10:46:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6a2c6865-5ee7-4cbf-9bd7-4ed08cfd5519
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6/
Threat name:
Win64.Trojan.Barys
Create hunting rule
Status:
Malicious
First seen:
2025-09-04 12:52:40 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3usxqjzlumgl5a6buick3354d6wse5aprauwjejugise6zxgd3a._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
donut_injector
Create hunting rule
Similar samples:
2a55227c52090516506ef41193831b78ef4e0e097ead8f9a75f83b896664167c
QuasarRAT
3662a8d4f950c9ebd0851e0b0713f2e48dfb7dd5ac3de02bae8acd1d6c4efd1d
QuasarRAT
4f19b203b30dbed626d518a2327ea3c554a439aa2b21952a4ef48ebade776d5a
QuasarRAT
5bf621e8d7c8590e3a2a5bb9779b5458b28f85b8887076b4a4885d1ee3e2c7f0
QuasarRAT
974752017f371e0c6b74ffa781f4ae43929d9504512c4d69340ecb612964e46e
QuasarRAT
b7b84a4fd1fa2d4fa0fa0abd1d76b5074375728c53f78af259ba49b1a18d4b73
QuasarRAT
c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
QuasarRAT
error
QuasarRAT
f3e081a4b2e4302d3b14e5f16aca269ea93aa5cb816bb7ac2a8e4f51a80f0fde
QuasarRAT
+ 178 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:quasar botnet:bit loader persistence spyware trojan
Link:
https://tria.ge/reports/250904-p4cptsfk4w/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Legitimate hosting services abused for malware hosting/C2
Detects DonutLoader
DonutLoader
Donutloader family
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
fuckrat.ru:1131
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6ef3fe33-cf53-45a1-b112-159895d330aa
Unpacked files
SH256 hash:
c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
MD5 hash:
69f5b19dc9d7675f57de11043992192d
SHA1 hash:
abc81778e20711075941cd11930be3b38a12f429
Link:
https://www.unpac.me/results/0e877aa0-8323-4022-95fd-a6853becc97b/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c6e92bc1395d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/25054/

Comments