MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
SHA3-384 hash: 7bb52877a0cac41a94767815d46b24af983a3b40c876e65d2780fc5d88520d01b54a56450de841a994457b0910fa73f3
SHA1 hash: 9aa046c32f4fa02f169402d85675480d65f524c0
MD5 hash: 6892e8230226a3353d942af64acc52a0
humanhash: carbon-india-red-pizza
File name:PhantomV.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:3'146'240 bytes
First seen:2026-03-20 15:01:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'859 x AgentTesla, 19'785 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 49152:ixiNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRr6jeu:dNgScVIxpLlwZNnAKSb7L3w0Xe
Threatray 131 similar samples on MalwareBazaar
TLSH T19CE5C02039EA401EF0B7AF75DBD0B4DA9A6EF263770AA65D149103464F23B41EDC713A
TrID 60.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
13.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter abuse_ch
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
PhantomV.exe
Verdict:
Malicious activity
Analysis date:
2026-03-20 04:48:53 UTC
Tags:
auto-sch pulsar rat crypto-regex
Link:
https://app.any.run/tasks/19bedbe5-3be4-47d0-ad89-24b79c4076b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58332/
Detection(s):
Win.Malware.Generic-9883083-0
Create hunting rule

Win.Malware.Bulz-9933026-0
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69bcd1b388c80c01586c4985
Tags:
hacktool emotet packed micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Launching a process
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Loading a suspicious library
Forced system process termination
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
Verdict:
Malicious
File Type:
exe x32
Detections:
PDM:Trojan.Win32.Tasker.cust PDM:Trojan.Win32.Generic Trojan-PSW.MSIL.Agent.sb Trojan.Win32.Agent.sb Trojan.MSIL.Agent.sb HEUR:Trojan.MSIL.R77.gen HEUR:HackTool.Win64.Disabler.pefng HEUR:HackTool.Win64.Disabler.gen
Link:
https://opentip.kaspersky.com/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/da28bed0-64aa-4f15-bf19-08fac5c8be44
Result
Threat name:
Quasar, defendnot Loader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1886947
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large strings
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates a thread in another existing process (thread injection)
Found API chain indicative of debugger detection
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Schedule system process
Sigma detected: Suspicious Script Execution From Temp Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected defendnot Loader
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1886947 Sample: PhantomV.exe Startdate: 20/03/2026 Architecture: WINDOWS Score: 100 69 ipwho.is 2->69 71 Found malware configuration 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 Multi AV Scanner detection for dropped file 2->75 77 12 other signatures 2->77 9 PhantomV.exe 9 2->9         started        13 defendnot-loader.exe 2->13         started        15 PhantVFixed.exe 2 2->15         started        signatures3 process4 file5 59 C:\Users\user\AppData\...\PhantVFixed.exe, PE32 9->59 dropped 61 C:\Users\user\AppData\Local\...\defendnot.dll, PE32+ 9->61 dropped 63 C:\Users\user\...\defendnot-loader.exe, PE32+ 9->63 dropped 97 Uses schtasks.exe or at.exe to add and modify task schedules 9->97 99 Adds a directory exclusion to Windows Defender 9->99 101 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->101 103 Potential Privilege Escalation using Task Scheduler highest RunLevel 9->103 17 PhantVFixed.exe 14 15 9->17         started        22 defendnot-loader.exe 9->22         started        24 powershell.exe 23 9->24         started        28 2 other processes 9->28 105 Writes to foreign memory regions 13->105 107 Allocates memory in foreign processes 13->107 109 Creates a thread in another existing process (thread injection) 13->109 26 Taskmgr.exe 13->26         started        signatures6 process7 dnsIp8 65 212.28.186.94, 4782, 49691 ABANETInternetServiceProviderIT Italy 17->65 67 ipwho.is 104.20.44.133, 443, 49694 CLOUDFLARENETUS United States 17->67 55 C:\Users\user\AppData\Local\...\defendnot.dll, PE32+ 17->55 dropped 57 C:\Users\user\...\defendnot-loader.exe, PE32+ 17->57 dropped 79 Antivirus detection for dropped file 17->79 81 Multi AV Scanner detection for dropped file 17->81 83 Adds a directory exclusion to Windows Defender 17->83 85 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->85 30 defendnot-loader.exe 17->30         started        33 powershell.exe 17->33         started        35 powershell.exe 17->35         started        37 schtasks.exe 17->37         started        87 Found API chain indicative of debugger detection 22->87 89 Writes to foreign memory regions 22->89 91 Allocates memory in foreign processes 22->91 93 Creates a thread in another existing process (thread injection) 22->93 39 Taskmgr.exe 22->39         started        95 Loading BitLocker PowerShell Module 24->95 41 conhost.exe 24->41         started        43 conhost.exe 28->43         started        45 conhost.exe 28->45         started        file9 signatures10 process11 signatures12 111 Multi AV Scanner detection for dropped file 30->111 113 Found API chain indicative of debugger detection 30->113 115 Writes to foreign memory regions 30->115 119 2 other signatures 30->119 47 Taskmgr.exe 30->47         started        117 Loading BitLocker PowerShell Module 33->117 49 conhost.exe 33->49         started        51 conhost.exe 35->51         started        53 conhost.exe 37->53         started        process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d/
Verdict:
Malicious
Threat:
Family.PULSARRAT
Link:
https://tip.neiki.dev/file/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
Threat name:
Win32.Backdoor.PulsarRat
Create hunting rule
Status:
Malicious
First seen:
2026-03-20 04:48:55 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vt2oicpsphpp6t66p2sek7jkhijg25qc2mqfqgehe7daggfibbwq._file
Verdict:
malicious
Label(s):
hacktool_defendnot
Create hunting rule
quasarrat
Create hunting rule
Similar samples:
30dfe87c5c3844e6d6a1ad8800c177cce116afe6b123ef385d6fc6df5b6f535a
QuasarRAT
4f831bfdd5b3ab7f4194b6fd391cac71b70ba7ced3489eb2bdf78170eb1214e9
QuasarRAT
653d9f4361cb046b9f4e376058ac1b2a66bcd014cce1089e68aabc1230430391
QuasarRAT
9f8b05f57597f6a61089e954ea1c2dfa24f1a4a72c5a2ff883a9fabb1203f658
QuasarRAT
acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
QuasarRAT
error
QuasarRAT
f66a4ee15f672bbf9259027eb286f369bfa81a3aa979f547415b831d22d031b5
QuasarRAT
+ 121 additional samples on MalwareBazaar
Result
Malware family:
defendnot
Create hunting rule
Score:
  10/10
Tags:
family:defendnot execution hacktool persistence
Link:
https://tria.ge/reports/260320-sekkxshw91/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Defendnot
Defendnot family
Detects Defendnot
Unpacked files
SH256 hash:
32ddcc8ec426baf56816514447c6cef2ef81b20b145946e7533401d3eb0ca929
MD5 hash:
ff508c605092d6aaf88651c4406162fb
SHA1 hash:
6986dd0dc239754ae457da779f065d70335190a5
Link:
https://www.unpac.me/results/e7ac1c31-57ef-4727-b615-60904a52a8f5/
SH256 hash:
1c1a49dc957ade033bd60dca58db3cc2221bd71bab7a20ab4f5009e98f13ff29
MD5 hash:
a70c5dc135347dde470f1e5b7edb4411
SHA1 hash:
e85c560a6aa24e2c64ad2a74b995a7316e8e8958
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
HKTL_NET_GUID_Quasar
Create hunting rule
Link:
https://www.unpac.me/results/e7ac1c31-57ef-4727-b615-60904a52a8f5/
Parent samples :
9382df4bc0f53192bd444266bac725b836d3633942fbbf617648536e449cf39e
acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
93ae860b34d78429fd3f4140cb2ca139bed29fa0f81d99cd35dce8f8024b0f0a
7e076c82e891f6cc0bff69929c87259a24380b2cfbd893330d68174140aab3a1
ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc
SH256 hash:
acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
MD5 hash:
6892e8230226a3353d942af64acc52a0
SHA1 hash:
9aa046c32f4fa02f169402d85675480d65f524c0
Link:
https://www.unpac.me/results/e7ac1c31-57ef-4727-b615-60904a52a8f5/
Malware family:
Defendnot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/acf4e409f279/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Costura_Protobuf
Create hunting rule
Author:@bartblaze
Description:Identifies Costura and Protobuf in .NET assemblies, respectively for storing resources and (de)serialization. Seen together might indicate a suspect binary.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Pulsar_RAT
Create hunting rule
Author:@bartblaze
Description:Identifies Pulsar RAT, based on Quasar RAT.
Reference:https://malpedia.caad.fkie.fraunhofer.de/details/win.pulsar_rat
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58332/

Comments