MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90d5dca5a7c377d98eb2e739ec1309304432827633ca25b2fa8e031c2f271429. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash:	90d5dca5a7c377d98eb2e739ec1309304432827633ca25b2fa8e031c2f271429
SHA3-384 hash:	4ca2e4140f52d574b0d1e86bb42c055130fa285de378c776a251973f4f4e69bee661a9e41923d29be16418f04491bfe1
SHA1 hash:	fb1a2e417475b138ce20ee701cd020cdb973fce4
MD5 hash:	f74bb47bdda7e7d715d8a579033c98a6
humanhash:	winner-ceiling-vermont-hot
File name:	file
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	5'915'136 bytes
First seen:	2026-02-18 18:03:03 UTC
Last seen:	2026-02-19 01:28:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4cea7ae85c87ddc7295d39ff9cda31d1 (86 x LummaStealer, 85 x RedLineStealer, 62 x Rhadamanthys)
ssdeep	98304:Aaffffffffff31LRaffffffffff31LcNffffffffhRgr0imalJPkoAMnv5dr6N3o:l6gaJsavvrcqxzFAsp1Ng
TLSH	T19756220168C95AD9F439463598B142300235BC570F916BEF899CBF73B812BC59D2BBBE
TrID	45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 QuasarRAT

Bitsight

url: http://130.12.180.43/files/6075866260/44NoKFh.exe

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Archives AutoIt

Details

Result

Malware family:

quasar

Score:

10/10

Tags:

family:chromelevator family:quasar botnet:shadow discovery execution hacktool persistence privilege_escalation spyware stealer trojan

Link:

https://tria.ge/reports/260218-wm54dads5h/

Behaviour

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Adds Run key to start application

Contacts third-party web service commonly abused for C2

Deletes itself

Executes dropped EXE

Reads user/profile data of web browsers

Downloads MZ/PE file

ChromElevator

Chromelevator family

Contains code to disable Windows Defender

Detects ChromElevator

Quasar RAT

Quasar family

Quasar payload

Malware Config

C2 Extraction:

https://pastebin.com/raw/fiQ3xXHg

Unpacked files

SH256 hash:

90d5dca5a7c377d98eb2e739ec1309304432827633ca25b2fa8e031c2f271429

MD5 hash:

f74bb47bdda7e7d715d8a579033c98a6

SHA1 hash:

fb1a2e417475b138ce20ee701cd020cdb973fce4

Link:

https://www.unpac.me/results/0364dcce-eae6-4cdc-a7d8-c802108b210d/

Malware family:

CypherIt

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/90d5dca5a7c3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/90d5dca5a7c377d98eb2e739ec1309304432827633ca25b2fa8e031c2f271429

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.