MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 20 File information Comments

SHA256 hash:	54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031
SHA3-384 hash:	9f82831345e9cf4b3b6b70247080fb07b3af926130cab84c30bbc58e60a54b82adaf1a1fbf43cdc4fadf2aec12e3b09a
SHA1 hash:	8c134e10dd21b2412efc3bf6fdcad6ea5dd05725
MD5 hash:	182e52b923b904611faedfdffa247731
humanhash:	william-muppet-maine-chicken
File name:	System.exe
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	1'624'576 bytes
First seen:	2025-05-29 01:32:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:ipL3MUu5RKS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9lsTHJoC:ipXu5O7wR2EgKKm77LrwCB6A8P
Threatray	42 similar samples on MalwareBazaar
TLSH	T11375F002B7F9810BE5BF5BB8987306590B37B593DA3AC74E198C605C1EE33419E51BA3
TrID	58.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 13.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.4% (.EXE) Win64 Executable (generic) (10522/11/4) 5.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	skocherhan
Tags:	exe github-Noxytheguy QuasarRAT

skocherhan

https://github.com/Noxytheguy/imcrazy/raw/refs/heads/main/System.exe

Intelligence

File Origin

# of uploads :

# of downloads :

464

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

Setup.exe.zip

Verdict:

Malicious activity

Analysis date:

2025-05-23 20:19:55 UTC

Tags:

arch-exec possible-phishing defendercontrol tool ta558 apt payload stegocampaign loader stealer reverseloader generic auto purelogs evasion phishing snake keylogger telegram amadey botnet github screenconnect remote miner coinminer rmm-tool bittorrent mozi upx autoit ftp lumma rat gh0st arch-doc metastealer redline zphp xworm arrow asyncrat rhadamanthys rustystealer loki ransomware lokibot donutloader gcleaner vidar chstealer

Link:

https://app.any.run/tasks/31f903da-f36c-4a82-8f9c-aeef0f835072

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/6128/

Detection(s):

Win.Malware.Generic-9883083-0

Win.Malware.Bulz-9933026-0

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL

Win.Malware.Generic-6623004-0

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6837ba6aacf88f5815e83e21

Tags:

vmdetect autorun quasar

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file

Creating a window

Сreating synchronization primitives

Creating a file in the %AppData% subdirectories

Launching a service

DNS request

Moving a recently created file

Searching for synchronization primitives

Connection attempt

Replacing files

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm anti-vm backnet base64 cmd cscript explorer fingerprint hacktool keylogger lolbin lolbin mshta netsh obfuscated packed packed packer_detected quasar quasarrat rat reconnaissance remote runonce schtasks update

Link:

https://www.filescan.io/uploads/6837b93f171e01f959301960/reports/68423dbb-6223-49b4-acc0-83cc09378ebd/overview

Verdict:

Malicious

Labled as:

Jalapeno.Generic

Link:

https://www.hybrid-analysis.com/sample/54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7cf67e84-ff86-40a4-9ef5-fa78b9aa8c6e

Result

Threat name:

Quasar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1701207

Signature

.NET source code contains potential unpacker

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Opens the same file many times (likely Sandbox evasion)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Quasar RAT

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031/

Threat name:

ByteCode-MSIL.Hacktool.Aikaantivm

Status:

Malicious

First seen:

2025-05-16 00:35:46 UTC

AV detection:

29 of 36 (80.56%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kqqszgkzgy5gb5pvrgn2iyitkedeuc33rdcuvorte5hg7hr4qayq._file

Verdict:

malicious

Label(s):

quasarrat

QuasarRAT

6d5faa0cd51cbe5d6fb33a09453d1a9ccfcbffc3fb715369026db4103b1605db

QuasarRAT

903387d93c8c1a877a89e1c8cb95b56ae96762f8694b0f95ee05ec6676936aa1

QuasarRAT

ce228d856a2a217ff4a0b5d2061c8414af08c222d3ce58b5a237ff27b54ef1f8

QuasarRAT

e4826272c8040d809f0813cd2835821d40ae2744d13968d1860e62fae5e7ac37

QuasarRAT

+ 32 additional samples on MalwareBazaar

Result

Malware family:

quasar

Score:

10/10

Tags:

family:quasar botnet:office04 spyware trojan

Link:

https://tria.ge/reports/250529-byckzswmz7/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Executes dropped EXE

Quasar RAT

Quasar family

Quasar payload

Malware Config

C2 Extraction:

Javv-46764.portmap.host:46764

Verdict:

Malicious

Tags:

red_team_tool rat quasar_rat backdoor backnet Win.Malware.Generic-9883083-0

YARA:

HKTL_EXE_AlKhaser_Jul_01 MAL_QuasarRAT_May19_1 malware_windows_quasarrat MAL_BackNet_Nov18_1

Link:

https://app.threat.zone/submission/b7bdf6e4-593b-4f36-9726-d82f03cae4ef

Unpacked files

SH256 hash:

54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031

MD5 hash:

182e52b923b904611faedfdffa247731

SHA1 hash:

8c134e10dd21b2412efc3bf6fdcad6ea5dd05725

Detections:

QuasarRAT

Link:

https://www.unpac.me/results/6efa7995-62e3-4824-a2ee-37640635fef3/

SH256 hash:

25654bb37f1247374916b140301f61d665238bb723d0c072560635b1f329b7e9

MD5 hash:

2358adfd8c5f1ef45b1cb094d9ddbf50

SHA1 hash:

786fadb531ee90fcfa63ded6f7dd0837b0ed5a3f

Detections:

SUSP_NET_Large_Static_Array_In_Small_File_Jan24

HKTL_NET_GUID_Quasar

Link:

https://www.unpac.me/results/6efa7995-62e3-4824-a2ee-37640635fef3/

Parent samples :

e3028ecd7637653dda1250fa2925e143796e385cda98191f04eec0681fd0c826
50cb6b8d0f572cd355d682a3f3529854b98cc75e141e452c98bec0279ef1ace2
030c62f201281c0034102b3cab64490e51b0499a9b5fad498f1ded30b23dbf66
903387d93c8c1a877a89e1c8cb95b56ae96762f8694b0f95ee05ec6676936aa1
54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031
78daa33cb739c0b1648f17599695cf0fc5ad0b1c7640d55d91e1d534a024c6f7
6597d0a917f2def35809cfcffd7c9098bc7e97eb62d35fb74486344208faf61a
0b484408c0a7a0d36bd2a1eaebd3030c98c88d786e92eb16b918b3a8b5c8bc9d
295f2ce9cc94f31573bf7b37f7ad43bcb4579ef0fa435c8fec0873214c6a43d2
5aa42451a5ac1ef0da91a240389b95cf535f34931f50540e4b3d6c38c9b68067

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54212c9959363a60f5f5899ba4611351064a0b7b88c54aba33274e6f9e3c8031

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	Costura_Protobuf Create hunting rule
Author:	@bartblaze
Description:	Identifies Costura and Protobuf in .NET assemblies, respectively for storing resources and (de)serialization. Seen together might indicate a suspect binary.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	MAL_BackNet_Nov18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects BackNet samples
Reference:	https://github.com/valsov/BackNet

Rule name:	MAL_BackNet_Nov18_1_RID2D6D Create hunting rule
Author:	Florian Roth
Description:	Detects BackNet samples
Reference:	https://github.com/valsov/BackNet

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	MAL_QuasarRAT_May19_1 Create hunting rule
Description:	Detects QuasarRAT malware

Rule name:	MAL_QuasarRAT_May19_1_RID2E1E Create hunting rule
Author:	Florian Roth
Description:	Detects QuasarRAT malware
Reference:	https://blog.ensilo.com/uncovering-new-activity-by-apt10

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)