MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a
SHA3-384 hash:	5755270d83fded00f87206121dd10ee98d3af3e3aca95ff85543a6d5b18de2e48e281c55e1451d1ecff103a432b83fb4
SHA1 hash:	39d341bd1f2c0e204a1ae968d11fba5fee9843d1
MD5 hash:	01e44e0c09a1baf1d1e575b4d8c0d81c
humanhash:	timing-fish-pasta-lemon
File name:	virt.bat
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	79'101 bytes
First seen:	2026-10-21 18:41:15 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	1536:6obU79Ck7ZphPKh3tw6Kh2kbEsCLoSKVvQ14mdjKd3x2dg9zwUhCR:6obU7L7shSjDb8oBvQ1MF0dgi1
TLSH	T10D73D0B3B50239293EF0179A58036C497F1FC6C51354E6EF2755A0BBE6BDA47CA0A520
Magika	batch
Reporter	BlinkzSec
Tags:	QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

US

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5cd117c9-c2a5-4ea0-a1c9-9931a18ac10b/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

bat

Verdict:

Malicious activity

Analysis date:

2026-10-21 20:18:43 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ac179df7-4a63-4e98-bf78-3e814bfdf396

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/93703/

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad9078a5a22ac805bd91e00

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a file

Creating synchronization primitives

DNS request

Sending a custom TCP request

Connection attempt

Sending an HTTP GET request

Launching a service

Connecting to a non-recommended domain

Using the Windows Management Instrumentation requests

Enabling autorun by creating a file

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost cscript lolbin obfuscated

Link:

https://www.filescan.io/uploads/6ad96584861203bc23e9085b/reports/93cd4554-d1bd-4aba-a2bd-52081420ac7e/overview

Hybrid Analysis TR/SNH

Verdict:

Suspicious

Labled as:

TR/SNH

Link:

https://www.hybrid-analysis.com/sample/9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-10T01:08:00Z UTC

Last seen:

2026-10-12T19:12:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a/

ReversingLabs TitaniumCloud Script-BAT.Trojan.Heuristic

Threat name:

Script-BAT.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-21 18:40:38 UTC

File Type:

Text (Batch)

AV detection:

4 of 36 (11.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tox7vgjaynmq2z3o5kd2gmln3wgx5o4wvag4ietwerhv7yxfjb5a._file

Threatray QuasarRAT

Verdict:

malicious

Label(s):

QuasarRAT

Alert

Create hunting rule

Link:

https://reports.threatray.com/b932c0ca-17b3-4963-8af6-d6dd582aaa69

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar execution persistence spyware trojan

Link:

https://tria.ge/reports/261021-xfa54ah18p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: JavaScript

Executes a command shell one-liner

Badlisted process makes network request

Family: Quasar RAT

Quasar payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

bat 9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a

(this sample)

Cape

https://www.capesandbox.com/analysis/93703/

  

URLhaus

https://urlhaus.abuse.ch/url/3955238/

  

Delivery method

Distributed via web download