🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876
SHA3-384 hash: 4acad37d33e57dc6cb7f85b7d22512a8dc15ae0a928505c19532c527608234700343e4dc94bedbd3c25531233c3e0e0d
SHA1 hash: 69f566e428badd9d72ee7a31cc45247b8fd968e3
MD5 hash: 0f56226cc743852339a2674258f1aa24
humanhash: summer-missouri-papa-hotel
File name:iloveyou.bat
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:359'181 bytes
First seen:2025-11-19 22:17:01 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 6144:E2a24N/vaRClNyMvSBFMUORGKeu0G+zmQXy1RNAgKM8oBSaY68uXXXB:vchaRONLvSEGKeu2zOpAPM8uSvqB
TLSH T10574F12E84DA0F2DCEF05A697CB91D4E129082C6527694DFFB6BDE077F9980C05AD09C
Magika batch
Reporter smica83
Tags:bat QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
iloveyou.bat
Verdict:
No threats detected
Analysis date:
2025-11-19 03:19:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bef2b3f5-da01-41f9-b137-efcfd62f8fa8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38737/
Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691e41ec27c5936d7d0ddcc7
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sending a custom TCP request
Using the Windows Management Instrumentation requests
DNS request
Creating a process from a recently created file
Creating a window
Running batch commands
Query of malicious DNS domain
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm conhost finger lolbin obfuscated powershell
Link:
https://www.filescan.io/uploads/691e41e627a01b9078de8025/reports/2a64be6b-0dd8-4aa3-bed4-1735717a5108/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876
Verdict:
Malicious
File Type:
text
First seen:
2025-11-20T07:31:00Z UTC
Last seen:
2025-11-20T07:39:00Z UTC
Hits:
~10
Detections:
Trojan.BAT.Obfus.bx
Link:
https://opentip.kaspersky.com/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spre.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1817322
Signature
Bypasses PowerShell execution policy
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Obfuscated command line found
Powershell drops PE file
Sets debug register (to hijack the execution of another thread)
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Download and Execution Cradles
Sigma detected: Powershell download payload from hardcoded c2 list
Sigma detected: Schedule system process
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1817322 Sample: iloveyou.bat Startdate: 19/11/2025 Architecture: WINDOWS Score: 100 117 ipwho.is 2->117 119 ihatefaggots.cc 2->119 121 2 other IPs or domains 2->121 129 Sigma detected: Powershell download payload from hardcoded c2 list 2->129 131 Sigma detected: Schedule system process 2->131 133 Sigma detected: Suspicious Command Patterns In Scheduled Task Creation 2->133 135 4 other signatures 2->135 12 cmd.exe 3 2->12         started        16 fB77O8.exe 2->16         started        18 fB77O8.exe 2->18         started        20 3 other processes 2->20 signatures3 process4 file5 115 C:\ProgramData\winner.bat, DOS 12->115 dropped 157 Obfuscated command line found 12->157 159 Uses schtasks.exe or at.exe to add and modify task schedules 12->159 22 conhost.exe 12->22         started        25 conhost.exe 12->25         started        27 powershell.exe 7 16->27         started        29 powershell.exe 18->29         started        31 powershell.exe 20->31         started        33 powershell.exe 20->33         started        35 powershell.exe 20->35         started        signatures6 process7 signatures8 137 Suspicious powershell command line found 22->137 139 Obfuscated command line found 22->139 37 powershell.exe 14 31 22->37         started        141 Bypasses PowerShell execution policy 25->141 42 cmd.exe 1 27->42         started        44 cmd.exe 29->44         started        46 cmd.exe 31->46         started        48 cmd.exe 33->48         started        50 cmd.exe 35->50         started        process9 dnsIp10 123 i.ibb.co.com 207.174.26.219, 443, 49715, 49725 RCN-ASUS United States 37->123 125 ihatefaggots.cc 158.94.209.205, 49722, 8889 JANETJiscServicesLimitedGB United Kingdom 37->125 127 ipwho.is 15.204.213.5, 443, 49724 HP-INTERNET-ASUS United States 37->127 113 C:\ProgramData\fB77O8.exe, PE32+ 37->113 dropped 143 Sets debug register (to hijack the execution of another thread) 37->143 145 Hides that the sample has been downloaded from the Internet (zone.identifier) 37->145 147 Loading BitLocker PowerShell Module 37->147 149 Powershell drops PE file 37->149 52 cmd.exe 1 37->52         started        54 cmd.exe 1 37->54         started        151 Obfuscated command line found 42->151 56 conhost.exe 42->56         started        59 conhost.exe 44->59         started        61 conhost.exe 46->61         started        63 conhost.exe 48->63         started        65 conhost.exe 50->65         started        file11 signatures12 process13 signatures14 67 conhost.exe 52->67         started        69 schtasks.exe 1 52->69         started        71 conhost.exe 54->71         started        73 schtasks.exe 1 54->73         started        153 Suspicious powershell command line found 56->153 155 Obfuscated command line found 56->155 75 powershell.exe 56->75         started        77 powershell.exe 59->77         started        79 powershell.exe 61->79         started        81 powershell.exe 63->81         started        83 powershell.exe 65->83         started        process15 process16 85 cmd.exe 75->85         started        87 cmd.exe 77->87         started        89 cmd.exe 79->89         started        91 cmd.exe 81->91         started        93 cmd.exe 83->93         started        process17 95 conhost.exe 85->95         started        97 schtasks.exe 1 85->97         started        99 conhost.exe 87->99         started        101 schtasks.exe 1 87->101         started        103 conhost.exe 89->103         started        105 schtasks.exe 1 89->105         started        107 conhost.exe 91->107         started        109 schtasks.exe 1 91->109         started        111 2 other processes 93->111
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=stwycm76zzsurpx6joik7yirjlot7x3pfsvqi6vrff5ukcw5lb3a._file
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar defense_evasion execution persistence spyware trojan
Link:
https://tria.ge/reports/251119-17frfawkgt/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Hide Artifacts: Ignore Process Interrupts
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Quasar RAT
Quasar family
Quasar payload
Malware Config
Dropper Extraction:
https://files.catbox.moe/4q6yuz.txt
https://files.catbox.moe/qt6070.txt
https://i.ibb.co.com/NfC1jKn/yu42mu5xn.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38737/

Comments