🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 22


Intelligence 22 IOCs YARA 40 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b
SHA3-384 hash: 9488e09826b625db98eac6f82733c890629bf2a1b63d2d5e8cd855369df5d5e9110954773de5617dc40ea6e3818338e3
SHA1 hash: 2554426fdfc4effe11c0ed59aff89377958c6c41
MD5 hash: a638481cb22f93846b3af0f9f9bb5626
humanhash: papa-charlie-grey-high
File name:Transferencia1142026.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:816'640 bytes
First seen:2026-11-05 07:07:11 UTC
Last seen:2026-11-09 07:43:16 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'350 x AgentTesla, 20'845 x Formbook, 12'417 x SnakeKeylogger)
ssdeep 12288:0f8Pqk4XtWKtsn4v5cL7wpcNe5EEMnOZbeGuS4RTTHKJuTyrkUBSFtcU/Louu0Ip:tP94AyH5mdEFZbJSTTJ8kUEFt3Euul
TLSH T1A105E0DD722471EEC867C1729A686C74F6502C6B871B4107942B3DAFBA3D887EF144B2
TrID 20.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
19.8% (.EXE) Win64 Executable (generic) (6522/11/2)
15.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.3% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon 78c0db4cea7aa0fc (33 x AveMariaRAT, 24 x QuasarRAT, 1 x Loki)
Reporter ni_fi_701
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
222
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Malware family:
quasar
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-05 07:25:17 UTC
Tags:
ip-check quasar rat auto-reg confuser
Link:
https://app.any.run/tasks/1abf96e0-2b9a-42f8-85d0-10dc676b707e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
QuasarRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/97359/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aec2b32baf1e56053e2a32b
Tags:
autorun quasar
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Creating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Launching a process
Sending a custom TCP request
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-11-04T20:00:00Z UTC
Last seen:
2026-11-05T03:45:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b/results?tab=lookup
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7d6fda80-3ad8-4242-8eb4-dcdebeccb991
Result
Threat name:
Quasar, XRat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1998782
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Quasar RAT
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Quasar RAT
Yara detected XRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998782 Sample: Transferencia1142026.exe Startdate: 05/11/2026 Architecture: WINDOWS Score: 100 57 tortyfivev.crabdance.com 2->57 59 goingcamprev.redirectme.net 2->59 61 ip-api.com 2->61 67 Suricata IDS alerts for network traffic 2->67 69 Found malware configuration 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 9 other signatures 2->73 11 Transferencia1142026.exe 1 2->11         started        15 Transferencia1142026.exe 2->15         started        signatures3 process4 file5 53 C:\Users\...\Transferencia1142026.exe.log, ASCII 11->53 dropped 83 Detected unpacking (changes PE section rights) 11->83 85 Uses schtasks.exe or at.exe to add and modify task schedules 11->85 87 Potential Privilege Escalation using Task Scheduler highest RunLevel 11->87 17 Transferencia1142026.exe 15 4 11->17         started        22 Transferencia1142026.exe 2 11->22         started        89 Injects a PE file into a foreign processes 15->89 24 Transferencia1142026.exe 15->24         started        26 Transferencia1142026.exe 15->26         started        signatures6 process7 dnsIp8 55 ip-api.com 208.95.112.1, 49705, 49707, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 17->55 51 C:\Users\user\AppData\...\blientcbp.exe, PE32 17->51 dropped 75 Detected Quasar RAT 17->75 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->77 28 blientcbp.exe 1 17->28         started        31 schtasks.exe 1 17->31         started        33 WerFault.exe 26->33         started        file9 signatures10 process11 signatures12 91 Antivirus detection for dropped file 28->91 93 Multi AV Scanner detection for dropped file 28->93 95 Injects a PE file into a foreign processes 28->95 35 blientcbp.exe 14 2 28->35         started        39 blientcbp.exe 28->39         started        41 conhost.exe 31->41         started        process13 dnsIp14 63 tortyfivev.crabdance.com 46.183.221.117, 49722, 61556 RIXHOSTLV Latvia 35->63 65 goingcamprev.redirectme.net 90.58.184.55, 61555 FranceTelecom-OrangeFR France 35->65 79 Detected Quasar RAT 35->79 81 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->81 43 schtasks.exe 35->43         started        45 WerFault.exe 22 18 39->45         started        47 conhost.exe 41->47         started        signatures15 process16 process17 49 conhost.exe 43->49         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b
Verdict:
inconclusive
YARA:
9 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 1.00 Win 32 Exe x86
Link:
https://app.malva.re/file/a638481cb22f93846b3af0f9f9bb5626
Detection:
quasar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b/
Threat name:
ByteCode-MSIL.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-11-05 07:08:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=afs5rox5454m6ics2d5d3ecmtsyhl6yuzvtgjmx2chrb5jdodonq._file
Verdict:
malicious
Label(s):
QuasarRAT
Create hunting rule
Link:
https://reports.threatray.com/b8b7b2c6-b958-49f3-960c-2376b01b16a8
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:aoy5 discovery execution persistence spyware trojan
Link:
https://tria.ge/reports/261105-hx987afg92/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
ConfuserEx .NET packer
Suspicious use of SetThreadContext
Looks up external IP address via web service
Executes dropped EXE
Family: Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
goingcamprev.redirectme.net:61555
tortyfivev.crabdance.com:61556
Malware Family:
n/a
Verdict:
Malicious
Tags:
injector loader rat
YARA:
SUSP_NET_NAME_ConfuserEx SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Link:
https://app.threat.zone/submission/4c5a6519-8bfe-45df-8182-116dce08d432
Malware Family:
msil
Create hunting rule
Malicious:
True
Tags:
dotnet obfuscated detect-debug-environment long-sleeps malware
Link:
https://intel.virussign.com/intelligence/file/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b
Unpacked files
SH256 hash:
0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b
MD5 hash:
a638481cb22f93846b3af0f9f9bb5626
SHA1 hash:
2554426fdfc4effe11c0ed59aff89377958c6c41
Detections:
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
SUSP_NET_NAME_ConfuserEx
Create hunting rule
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/1b24d3cf-ed36-483b-bf52-a0b22aef891a/
SH256 hash:
d7402cb3b566d21e3c090713d8b681f488a43fc4eec8b6d607709fad87252aff
MD5 hash:
d8196d7404e41679826c1d45cebfb3c5
SHA1 hash:
8a641aa188ce1d3617ff76fde10459e177b32765
Link:
https://www.unpac.me/results/1b24d3cf-ed36-483b-bf52-a0b22aef891a/
SH256 hash:
7e02326b6762524abfc56934a828093c010aeda90a5cfe9710b56787eb32427e
MD5 hash:
be86666e7b901c68ec56941fd51379c5
SHA1 hash:
8f78a4748a493198fd9b5755d6256c39ad10d3d4
Detections:
QuasarRAT
Create hunting rule
CN_disclosed_20180208_KeyLogger_1
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
MAL_QuasarRAT_May19_1
Create hunting rule
malware_windows_xrat_quasarrat
Create hunting rule
MALWARE_Win_QuasarRAT
Create hunting rule
Quasar
Create hunting rule
Quasar_RAT_1
Create hunting rule
Quasar_RAT_2
Create hunting rule
Vermin_Keylogger_Jan18_1
Create hunting rule
win_quasar_rat_client
Create hunting rule
win_quasarrat_j1
Create hunting rule
xRAT_1
Create hunting rule
Link:
https://www.unpac.me/results/1b24d3cf-ed36-483b-bf52-a0b22aef891a/
Malware family:
xRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0165d8bafde7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0165d8bafde778cf2052d0fa3d904c9cb075fb14cd6664b2fa11e21ea46e1b9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_KeyLogger_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:CN_disclosed_20180208_KeyLogger_1_RID3227
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:HUNT_NET_Loader_ImagePixel_To_AssemblyLoad
Create hunting rule
Author:Anish Bogati
Description:Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.
Rule name:implant_win_quasarrat
Create hunting rule
Author:Sekoia.io
Description:Detect QuasarRAT (reted from samples 2023-03)
Reference:https://blog.alyac.co.kr/5103
Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:malware_Quasar_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:MALWARE_Win_QuasarRAT
Create hunting rule
Author:ditekSHen
Description:QuasarRAT payload
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (https://www.lukeacha.com)
Description:Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:quasarrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:quasarrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_1_RID2B54
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2
Create hunting rule
Description:Detects Quasar RAT
Rule name:Quasar_RAT_2_RID2B55
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:suspicious_PEs
Create hunting rule
Author:txc
Description:This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Vermin_Keylogger_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Vermin Keylogger
Reference:https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
Rule name:VIGIA_QuasarRAT_01656ed2
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:QuasarRAT candidate detection using source-sample artifacts and compositional family indicators
Reference:https://vigia.bisite.es/
Rule name:VIGIA_QuasarRAT_243ea4d3
Create hunting rule
Author:VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:QuasarRAT family indicators and original MeridanBuilt installer artifacts
Reference:https://vigia.bisite.es/
Rule name:Windows_Trojan_Quasarrat_e52df647
Create hunting rule
Author:Elastic Security
Rule name:WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Derialock (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:win_quasar_rat_client
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in Quasar Rat Samples.
Rule name:xRAT_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W
Rule name:xRAT_1_RID2900
Create hunting rule
Author:Florian Roth
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/97359/

Comments