MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2
SHA3-384 hash:	9781fcbb195064a5ba5de7a265a8b7ff9ef306430abb4c42a2254e5d8df4f97e60c467843e12190b7681a50bce539dcd
SHA1 hash:	634cbf76119c4a9b9fb9153639c1877e46a6a480
MD5 hash:	a71c9c9b77cf401a7f9a3a2e8a72f1f5
humanhash:	butter-happy-sink-yellow
File name:	encrypted.hta
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	13'844 bytes
First seen:	2026-04-09 10:44:28 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	384:Z0YYnMV3udrO+lGFk6GHX8TIU5Le9SbArVZ9tM09SsHZvlkE4wkLtocNNtOrEPJ8:mKc
TLSH	T1CD527A2C09BDFA5993D9E213E699F7276D4A1CAFC2B875172AF38C6890024C045EB4C7
Magika	html
Reporter	abuse_ch
Tags:	hta QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

44

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

TwinWave.EvilHTA.DridexEsqCigarettesNAlcohol.M2.20211202.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d783596a61012f6ad0539c

Tags:

xtreme virus sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 powershell

Link:

https://www.filescan.io/uploads/69d783529124ebc0874de989/reports/6550d415-11cf-423a-922b-74974425968d/overview

Hybrid Analysis VBS:Electryon.420

Verdict:

Malicious

Labled as:

VBS:Electryon.420

Link:

https://www.hybrid-analysis.com/sample/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-04-02T12:33:00Z UTC

Last seen:

2026-04-06T16:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1895883

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Parents

Suspicious powershell command line found

Tries to download files via bitsadmin

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2/

Neiki Family.QUASAR

Verdict:

Malicious

Threat:

Family.QUASAR

Link:

https://tip.neiki.dev/file/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2

ReversingLabs TitaniumCloud Script-WScript.Trojan.Electryon

Threat name:

Script-WScript.Trojan.Electryon

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-02 14:47:06 UTC

File Type:

Text (VBS)

AV detection:

9 of 36 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kjpst4ksttm57s5cmkybf2ixbyzljxnrqtqtm7rnka3tg4illsra._file

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar discovery dropper execution spyware trojan

Link:

https://tria.ge/reports/260409-mtpwaset9j/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Contacts third-party web service commonly abused for C2

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Download via BitsAdmin

Downloads MZ/PE file

Quasar RAT

Quasar family

Quasar payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2