MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a
SHA3-384 hash: 9faee877bad4a920ab87ab0caba78dbb7c771b9d94a5d0118c33c31494f3397f26e26eacb016e36f198794a59ed31871
SHA1 hash: d0a01c70969098d585f5333b99c3bc18b16d3c8b
MD5 hash: 656d3a3a7cd96df70e34ed0ad5799a86
humanhash: kilo-wolfram-angel-zulu
File name:Game.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:20'063'232 bytes
First seen:2025-08-28 22:52:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c648d7a0d993de34ca8bb4360f96014 (1 x QuasarRAT)
ssdeep 393216:k63hSwCcxORpwirkY8U3sKTxesi0NYYxC:k+S3cAp2oDNesiRYxC
TLSH T19C17E00BFF6647E5C43C813890AB17D6B7B2B069037287A79AB041275FB63C19D6AF14
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter nickkuechel
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Game.exe
Verdict:
Malicious activity
Analysis date:
2025-08-28 22:52:33 UTC
Tags:
auto-reg evasion
Link:
https://app.any.run/tasks/b521b52d-ac46-4f27-b530-58b600292e5b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24068/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b0ddb5eb163e0ec1830286
Tags:
autorun quasar
Result
Verdict:
Malware
Maliciousness:

Behaviour
Adding an access-denied ACE
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Launching a process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug microsoft_visual_cc overlay overlay packed
Link:
https://www.filescan.io/uploads/68b0dd9c39a6221faa73de06/reports/17710853-a2d8-4d0e-954f-c4f0cac9f990/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-08-22T18:26:00Z UTC
Last seen:
2025-08-22T18:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a/results?tab=lookup
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/656d3a3a7cd96df70e34ed0ad5799a86
Gathering data
Verdict:
Malicious
Threat:
Family.QUASAR
Link:
https://tip.neiki.dev/file/9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-08-22 22:52:29 UTC
File Type:
PE+ (Exe)
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tva2p5vqqonvivbajfaglj5f4p5dmadnoyzubipbwgvth22h4f5a._file
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:copilot defense_evasion execution persistence spyware trojan
Link:
https://tria.ge/reports/250828-2tm42adj8s/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Modifies trusted root certificate store through registry
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
147.185.221.31:7687
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/911892bc-dcb2-405c-830c-5e7da9b9ee77
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9d41a7f6b083/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d41a7f6b0839b545420494065a7a5e3fa36006d763340a1e1b1ab33eb47e17a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:crime_win32_ransom_avaddon_1
Create hunting rule
Author:@VK_Intel
Description:Detects Avaddon ransomware
Reference:https://twitter.com/VK_Intel/status/1300944441390370819
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/24068/

Comments