MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2
SHA3-384 hash: e1edfeccc930d156774e7e8f029682d976821deb18a2a6e223048cd46864b64024b829da4ee7d1a3b0510c90807933cd
SHA1 hash: 49d1dc112e7020287d9768a8dd6d0dda1b40aabd
MD5 hash: 54581a62580e658ad39165a8a1f6322c
humanhash: purple-rugby-high-spring
File name:start_qsr.ps1
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:2'272 bytes
First seen:2026-04-14 14:07:50 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:7qRivXobo+GyUSnt4M9JVm4BKpCmtM9h4BKpCmUCo6jnQrcrA/h+glAfpmfYmvn:uRgXj+GhStFVuopoQxdcfDvn
Threatray 13 similar samples on MalwareBazaar
TLSH T10241F11AB94956E9804B5236ACE756023E9E506F111E9820BEFDC0C5BFC1E6FCFB1468
Magika powershell
Reporter BlinkzSec
Tags:QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.PUA.IA.Suspicious.74391316.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69de4a7245787c53e539a2de
Tags:
infosteal quasar
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
dropper obfuscated
Link:
https://www.filescan.io/uploads/69de574b5ea31bc68a29ea94/reports/3d33c6bd-e4fb-416c-9b41-2690e295287f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2
Verdict:
Malicious
File Type:
ps1
First seen:
2026-04-14T11:33:00Z UTC
Last seen:
2026-04-16T04:51:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Quasar.sb Trojan.MSIL.Quasar.a Trojan-PSW.Win32.Stealer.sb Trojan-PSW.MSIL.Agent.sb HEUR:Trojan.Win64.Reincarnation.gen HEUR:Trojan.PowerShell.Generic HEUR:Trojan.MSIL.Quasar.gen HEUR:Trojan-Spy.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2/results?tab=lookup
Score:
6%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2/
Verdict:
Malicious
Threat:
Family.QUASAR
Link:
https://tip.neiki.dev/file/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-14 13:56:21 UTC
File Type:
Text (PowerShell)
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ijm7vmmp7xouwqgkgcl53t4kbdiryblrp6lvyueslvlhbqbhf3za._file
Verdict:
malicious
Label(s):
admintool_nssm
Create hunting rule
Similar samples:
4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2
QuasarRAT
4a8e2ca5f5a65c73e3e910d06b5760ab18177e94d0da8f0c7ec22caee404ac87
QuasarRAT
4b0b811922ef54485f8bb75aaadeedf70f173d56d958d5b980b8abcaaefb6540
QuasarRAT
4d1e682b22632faafe730584ce724bb60ad384a2b6974fe5f72e9df76b344bbe
QuasarRAT
778999ec7de998a62cf77f6b0ac379915e31093c4753c00629bfd51160fb2150
QuasarRAT
c605c90af10dbc8033e7f4d9aa6f999583a419d699907a14d8d72d08ffdb9e4c
QuasarRAT
error
QuasarRAT
+ 3 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:office04 execution spyware trojan
Link:
https://tria.ge/reports/260414-rfwtxacw8n/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Drops file in System32 directory
Looks up external IP address via web service
Executes dropped EXE
Badlisted process makes network request
Downloads MZ/PE file
Family: Quasar RAT
Quasar payload
Malware Config
C2 Extraction:
132.243.173.55:28370
192.168.130.*:28370
192.168.129.*:28370
192.168.128.*:28370
192.168.144.*:28370
192.168.149.*:28370
192.168.147.*:28370
x.x.x.x:28370
Dropper Extraction:
http://[SERVER_IP]/[BOT_SLUG]/
http://132.243.173.111:3000/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

PowerShell (PS) ps1 4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3821453/
  
Delivery method
Distributed via web download

Comments