MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3f7c3e6ad47622eb559c923c12fe588fe4bf14bff307fafbcfc1b1fb08f64457. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
QuasarRAT
Vendor detections: 18
| SHA256 hash: | 3f7c3e6ad47622eb559c923c12fe588fe4bf14bff307fafbcfc1b1fb08f64457 |
|---|---|
| SHA3-384 hash: | b8fd7c7f89b7f0f040b1d26fa73fde2f1fa7b7fdb497a33e81479553c39971d8cd0285562ce1e11e0db72395830b4696 |
| SHA1 hash: | 153747ed6551431b9bce96c51e4b96b3a901a51d |
| MD5 hash: | 8f3d5f02a08c5d0d722cdd5bab6c1429 |
| humanhash: | london-helium-angel-oven |
| File name: | SL P2P 거래 체결 양식서.PDF.PIF |
| Download: | download sample |
| Signature | QuasarRAT |
| File size: | 1'351'168 bytes |
| First seen: | 2025-05-19 00:23:16 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'672 x AgentTesla, 19'489 x Formbook, 12'212 x SnakeKeylogger) |
| ssdeep | 24576:FPzSeyEUT9RBU1256xg2SzSTmzwc4lg6pBmuKpZFHpv:FrSeyEUT9RBq25J1GJlgMBAZz |
| Threatray | 190 similar samples on MalwareBazaar |
| TLSH | T10455D00E1ADA15E0E4ED5E74E7B801EC56B1B62B5822F37E168153F9CF2134A68127F3 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  chany_2112 |
| Tags: | exe QuasarRAT RAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
570
Origin country :
KRVendor Threat Intelligence
Malware family:
quasar
ID:
1
File name:
SL P2P ê±°ë ì²´ê²° ììì.PDF.PIF
Verdict:
Malicious activity
Analysis date:
2025-05-19 00:24:05 UTC
Tags:
httpdebugger tool evasion quasar rat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.1%
Tags:
agenttesla virus remo sage
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Creating a file in the %AppData% subdirectories
Launching a process
Searching for synchronization primitives
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 masquerade obfuscated obfuscated vbnet
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Malware family:
Quasar RAT
Verdict:
Malicious
Result
Threat name:
Quasar, DarkTortilla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
Detected Quasar RAT
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected DarkTortilla Crypter
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.Jalapeno
Status:
Malicious
First seen:
2025-05-19 00:24:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
45
AV detection:
23 of 24 (95.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
venomrat
Similar samples:
+ 180 additional samples on MalwareBazaar
Result
Malware family:
quasar
Score:
10/10
Tags:
family:quasar botnet:sin discovery spyware trojan
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Checks computer location settings
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
rajaroos817.mooo.com:1119
Verdict:
Malicious
Tags:
quasar azorult qasar_rat voidrat ip_address_lookup_website external_ip_lookup
YARA:
n/a
Unpacked files
SH256 hash:
3f7c3e6ad47622eb559c923c12fe588fe4bf14bff307fafbcfc1b1fb08f64457
MD5 hash:
8f3d5f02a08c5d0d722cdd5bab6c1429
SHA1 hash:
153747ed6551431b9bce96c51e4b96b3a901a51d
SH256 hash:
da4cb91d96214c7134a9e8799fdf241bd6b8103eecd4efb1b8c228ca3c8e7e91
MD5 hash:
9a06e083cd0531927dcd616b9b601ffa
SHA1 hash:
9584f7e1c8ab7be5900762abcaedf20cb92e4ae7
SH256 hash:
7d18c2e0fd8fdcbe12ecebef0aa18a34c31f587ab7929eccbf07f8a55c4eefff
MD5 hash:
45542cc23f6714f0f535fcbc7fc3b1bc
SHA1 hash:
998f7cce46f4d56af8eb92e4812f6ac4af06e684
SH256 hash:
2cb5b8fbcd0994c8371837858c1f6dfe8e0de017e86437c7aee38d710209f10a
MD5 hash:
4f5880d558000b383fbb6efb21100997
SHA1 hash:
d2ceb9140d797b0f4db46a0a02c274e4fe89f349
SH256 hash:
2b34f74bb136fd8315f272cace5ef9cfda4054cca7e6028e1652d87a5c4d45f3
MD5 hash:
08737c89b4dad7cb141a32798eedead6
SHA1 hash:
e0f5a7b76ea0d512de30cfe42e96dfd0c288a1ef
Detections:
QuasarRAT
cn_utf8_windows_terminal
malware_windows_xrat_quasarrat
Quasar_RAT_1
Quasar_RAT_2
MAL_QuasarRAT_May19_1
Vermin_Keylogger_Jan18_1
xRAT_1
CN_disclosed_20180208_KeyLogger_1
win_quasarrat_j1
Quasar
win_quasar_rat_client
INDICATOR_SUSPICIOUS_GENInfoStealer
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
MALWARE_Win_QuasarRAT
Malware family:
QuasarRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.PIF -> DLL -> EXE