MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896
SHA3-384 hash:	6377144c3828d2b9f8cfbba92b2e82c0cfcc7778e0432fdd9684c0c428d358d34c488c0ccdce8041d5215d4e2c958da0
SHA1 hash:	4aafe940d5a606256e5ed8d899415c69c22e3a7d
MD5 hash:	4a179a29e1a8313eeeb35aa1ec4812fb
humanhash:	hot-grey-fillet-arizona
File name:	DetectionRateTesting.hta
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	13'890 bytes
First seen:	2026-04-09 06:27:35 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	384:PzPQvnTWGFkSa3UjFvNW4lN3bI5P+ZwbzzaTiWWvQA6c1zx/KFSWsu9d3zyQBzix:PzIe7
TLSH	T15352782C09BDFA5893D9E307E699F7276D465CAFC2B975172AF28C6CA0024C045EB4C7
Magika	html
Reporter	abuse_ch
Tags:	hta QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

41

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

TwinWave.EvilHTA.DridexEsqCigarettesNAlcohol.M2.20211202.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d7470d6a61012f6ad04458

Tags:

xtreme virus sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis VBS:Electryon.420

Verdict:

Malicious

Labled as:

VBS:Electryon.420

Link:

https://www.hybrid-analysis.com/sample/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

hta

First seen:

2026-04-02T23:14:00Z UTC

Last seen:

2026-04-10T23:54:00Z UTC

Hits:

~100

Detections:

Trojan.MSIL.Agent.sb Trojan-Downloader.Win32.Bitser.sb PDM:Exploit.Win32.Generic HEUR:Trojan.Win32.Generic Backdoor.MSIL.PulsarRAT.sb Trojan.JS.SAgent.sb Trojan-PSW.MSIL.Agent.sb Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.MSIL.Convagent.gen HEUR:Trojan-Banker.MSIL.ClipBanker.gen HEUR:Trojan.Script.Generic

Link:

https://opentip.kaspersky.com/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1895697

Signature

Benign windows process drops PE files

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Parents

Suspicious powershell command line found

Tries to download files via bitsadmin

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896/

Neiki Family.QUASAR

Verdict:

Malicious

Threat:

Family.QUASAR

Link:

https://tip.neiki.dev/file/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896

ReversingLabs TitaniumCloud Script-WScript.Trojan.Electryon

Threat name:

Script-WScript.Trojan.Electryon

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-03 01:29:18 UTC

File Type:

Text (VBS)

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x3ar7ld5fv5lrgvdbwa7eai4bxrjmr6544ey3snmu4qstpv3tcla._file

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar discovery dropper execution spyware trojan

Link:

https://tria.ge/reports/260409-g8kbgact9x/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Contacts third-party web service commonly abused for C2

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Download via BitsAdmin

Downloads MZ/PE file

Quasar RAT

Quasar family

Quasar payload

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896