MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 30 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
SHA3-384 hash: 55ba3fed45449ca9e15422777042ab1e7cc92dd6ab52eb7ce35f6bf6eb83c947ab8bd18f78df23f8d61e08d0ddedeed6
SHA1 hash: d6b37b1fdc0e761fa46b4fe40bee17209a25941f
MD5 hash: 3f7812851aaa169facde987dba81640f
humanhash: virginia-wisconsin-hydrogen-island
File name:Pulsar-Client.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'564'160 bytes
First seen:2025-10-22 16:24:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:v2oiHUvXRJgRD1sdJ7GrUnxa1eoUztQd7zU4GdUtS+gZ/spbDMfX2NF1ay:vsHUvX1ileoUKNthbmXPy
TLSH T1D4757C5077AC8B36D7AF4ABAF4B145050B71E607A163E3AF44C8B1F91DA378299103B7
TrID 58.8% (.RLL) Microsoft Resource Library (x86) (177572/6/26)
24.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
5.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.4% (.EXE) Win64 Executable (generic) (10522/11/4)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika pebin
Reporter JAMESWT_WT
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Pulsar-Client.exe
Verdict:
Malicious activity
Analysis date:
2025-10-22 02:00:50 UTC
Tags:
evasion crypto-regex
Link:
https://app.any.run/tasks/d0007d08-98b8-481e-908e-10852d6515f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33780/
Detection(s):
Win.Malware.Generic-9883083-0
Create hunting rule

Win.Malware.Bulz-9933026-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f90557ad6ce0f5ad40b423
Tags:
vmdetect quasar emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Setting a keyboard event handler
Connection attempt to an infection source
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm base64 base64 cmd cscript evasive expired-cert explorer fingerprint hacktool lolbin msbuild mshta net obfuscated privilege quasar reconnaissance regasm regsvcs runonce schtasks stack_pickle update
Link:
https://www.filescan.io/uploads/68f9055211ff3db29f665eff/reports/590d20d0-475b-44c7-8b5f-23a918a1b8c6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-21T23:45:00Z UTC
Last seen:
2025-10-22T13:45:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Banker.MSIL.ClipBanker.gen HEUR:Trojan.Win32.Generic Trojan-PSW.MSIL.Agent.sb Trojan.MSIL.Quasar.fgq Trojan.MSIL.Quasar.a Trojan.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/128555c6-83a4-4daa-9e88-4da31b036448
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
Verdict:
QuasarRat
YARA:
16 match(es)
Tags:
.Net Executable Fody/Costura Packer Html Malicious Managed .NET PDB Path PE (Portable Executable) PE File Layout QuasarRat RAT SOS: 0.14 SOS: 0.15 SOS: 0.17 SOS: 0.18 SOS: 0.23 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.63 Win 32 Exe x86
Link:
https://app.malva.re/file/3f7812851aaa169facde987dba81640f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245/
Verdict:
Malicious
Threat:
Family.QUASAR
Link:
https://tip.neiki.dev/file/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
Threat name:
Win32.Hacktool.Aikaantivm
Create hunting rule
Status:
Malicious
First seen:
2025-10-22 04:42:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
30 of 37 (81.08%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=payopqilko7xsdx5jrvv2uxaymolqpmgg6gcv3xznv64rvzg6jcq._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
error
QuasarRAT
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar spyware trojan
Link:
https://tria.ge/reports/251022-twr7rsgp3z/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Quasar RAT
Quasar family
Quasar payload
Verdict:
Malicious
Tags:
red_team_tool rat quasar_rat backdoor backnet Win.Malware.Generic-9883083-0
YARA:
HKTL_EXE_AlKhaser_Jul_01 HKTL_NET_GUID_Quasar MAL_QuasarRAT_May19_1 malware_windows_quasarrat MAL_BackNet_Nov18_1
Link:
https://app.threat.zone/submission/93f1a64d-cde4-4219-a942-8d2b200b86a2
Unpacked files
SH256 hash:
7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
MD5 hash:
3f7812851aaa169facde987dba81640f
SHA1 hash:
d6b37b1fdc0e761fa46b4fe40bee17209a25941f
Detections:
QuasarRAT
Create hunting rule
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 hash:
cb5b861883d2bddd9833c9fe956406f7
SHA1 hash:
43290cd4aaf80df5d1cf9f242486ef8e646fddda
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 hash:
e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 hash:
2242627282f9e07e37b274ea36fac2d3cd9c9110
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
067413dff0f9d7a386fe3968cb3988594e68f647c157502ab11d939fc8e2d6ef
MD5 hash:
e2fbecbb3953cb5d5de98a38e5323095
SHA1 hash:
b57b485ba7372fb3403fd0c36043a051af2afc05
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
4d7aa07d288c6a39109eedf6435e3ba8c413342876ed08bb5a64d55dd39dd04d
MD5 hash:
3876cd00a3ad6d0a5fdbfc19877f300a
SHA1 hash:
a0690708c86f009d41fda400fead8407b8168895
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 hash:
ecdfe8ede869d2ccc6bf99981ea96400
SHA1 hash:
2f410a0396bc148ed533ad49b6415fb58dd4d641
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
MD5 hash:
af7880a90c02c0115cd169c7182ab378
SHA1 hash:
6e3ccf50bb1d30805dce58ab6bdd63e0196669e6
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
Parent samples :
51974d6489023e692699475f2a5d25e986b2e1e6c191bf8f3e51100347981dfd
7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245
SH256 hash:
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 hash:
f09441a1ee47fb3e6571a3a448e05baf
SHA1 hash:
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
1e02248fc226f1813f9a473aaf8dc9bd264101a6e371ddb73e145c0949834d47
MD5 hash:
4b874a3043d5e3c133f4c35863159638
SHA1 hash:
3a7d21700497d81c41193544b7ea913032d0aa82
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
SH256 hash:
8a6afb98deea2448fc892ae374a07ffbd70b20dadf934e74146cf0b91cc073e7
MD5 hash:
56bbe8a78f0382a3738b220b46cb0f12
SHA1 hash:
19ca3345f4eea4e08f81e8bc43b102d4cf824e8d
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
HKTL_NET_GUID_Quasar
Create hunting rule
Link:
https://www.unpac.me/results/3b123438-d784-4fa0-9fc3-d31e4fa52a56/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7830e7c10b53/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7830e7c10b53bf790efd4c6b5d52e0c31cb83d86378c2aeef96d7dc8d726f245

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_Dlls
Create hunting rule
Rule name:Check_VBox_Guest_Additions
Create hunting rule
Rule name:Check_VmTools
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HKTL_NET_GUID_Quasar
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects c# red/black-team tools via typelibguid
Reference:https://github.com/quasar/Quasar
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:MAL_BackNet_Nov18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:MAL_BackNet_Nov18_1_RID2D6D
Create hunting rule
Author:Florian Roth
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Description:Detects QuasarRAT malware
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/33780/

Comments