MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56
SHA3-384 hash: 5e29df2c9bc93b2cfb3f9a223aaca43164dfc4d16d00a5297dd11a1cd762768cf224b07f7cacfdf215c068877ab32545
SHA1 hash: 55848021964e52ef1cb1c0e3040d34880ef7a8e9
MD5 hash: 877ec872071100e04a4154315aa10aa4
humanhash: nevada-arizona-crazy-one
File name:output.bat
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:565'982 bytes
First seen:2026-07-08 10:56:12 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 12288:XtAQor6pJq1tV9PojubUkvhz58HYOyTnoZpFRAY0:dAQor6pJqR9hpF58Hh2WRy
TLSH T124C423005DFB073E46A0876935638A8F27E94DEEC1A8B8A577FA04876F4F74A45DF408
Magika batch
Reporter JAMESWT_WT
Tags:103-217-253-29 104-249-10-191 bat QuasarRAT uiutils-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
clifix.txt
Verdict:
Malicious activity
Analysis date:
2026-07-08 10:52:45 UTC
Tags:
susp-clipboard clickfix possible-phishing exploit evasion susp-script emmenhtal
Link:
https://app.any.run/tasks/3f01f288-d7b7-472f-bef0-7989cab8fefb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73932/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4e2cf613f68731ed6a90ec
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
DNS request
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 conhost finger lolbin obfuscated powershell
Link:
https://www.filescan.io/uploads/6a4e2ce13463d2374e2ceb6e/reports/0ac313ed-1045-4fd2-9d1e-c4bb1ec23611/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-08T08:12:00Z UTC
Last seen:
2026-07-09T12:58:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic PDM:Exploit.Win32.Generic HEUR:Trojan.BAT.Alien.gen
Link:
https://opentip.kaspersky.com/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56/results?tab=lookup
Score:
87%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjttzyeffnazyphpm2xuntxun2n6v2c5xbx2fhdmuvbjh4thp5la._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
error
QuasarRAT
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar adware costura execution packer persistence spyware trojan
Link:
https://tria.ge/reports/260708-m11alsev5x/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Costura .NET executable packer
Enumerates connected drives
Badlisted process makes network request
Boot or Logon Autostart Execution: Active Setup
Command and Scripting Interpreter: PowerShell
Family: Quasar RAT
Quasar payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Batch (bat) bat 52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/73932/
  
URLhaus
https://urlhaus.abuse.ch/url/3883928/
  
Delivery method
Distributed via web download

Comments