MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 15 File information Comments

SHA256 hash:	bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff
SHA3-384 hash:	1541b56f74aeab80599f80aca6ac9f19ad7035d4eff13bad368db0f9478f803661186077506218cfff5d560464216722
SHA1 hash:	b375573147ad807699ebc696fc35b01d0298c99d
MD5 hash:	457013a94eefd116aeb5dd4762c3c44e
humanhash:	ceiling-august-uncle-delta
File name:	bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff.bin
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	319'488 bytes
First seen:	2026-11-10 12:07:34 UTC
Last seen:	2026-11-10 12:49:12 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
ssdeep	6144:lTeJ8V7hPutIID9+rxGEKWPNRLXBmvmqjhdqX3/zxLfDY1QcDd:l6JUPILMrxGEKWnFemqLO3dr0
TLSH	T1BE64C6D0D484E1ABD221A776A18AFFB0656B2FE53E05F1224050BFE3335385F8A7A457
TrID	30.0% (.EXE) Win64 Executable (generic) (6522/11/2) 23.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.5% (.EXE) Win16/32 Executable Delphi generic (2072/23) 9.4% (.ICL) Windows Icons Library (generic) (2059/9) 9.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	kernelv0id
Tags:	exe QuasarRAT

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

TelegramBot

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7d5564be-2c58-43cd-a2f7-67a7c77128e9/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99141/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af30935463538821bc39e76

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

evasive hacktool masquerade overlay

Link:

https://www.filescan.io/uploads/6af30937a43553dc602d8dff/reports/d32b7396-0e42-4e8d-94bc-d08b5e19f813/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff

Verdict:

Unknown

File Type:

exe x64

Link:

https://opentip.kaspersky.com/bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a720ad29-d120-4ff4-b670-3c17f29c211d

Result

Threat name:

Zaraza Stealer

Detection:

malicious

Classification:

troj

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/2003199

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Zaraza Stealer

Behaviour

Behavior Graph:

Download SVG

Verdict:

QuasarRat

YARA:

6 match(es)

Tags:

.Net Executable Malicious Managed .NET PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) QuasarRat RAT SOS: 0.30 Win 64 Exe x64

Malware Config

C2 Extraction:

PORT: ChainingModeGCM
CNC: ChainingModeGCM

Link:

https://app.malva.re/file/457013a94eefd116aeb5dd4762c3c44e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x7c5jddnm4ir3eho5nwgtujdn4e4npp6vfawhyvpnahbniasud7q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261110-pa1vkasygw/

Malware Family:

n/a

Verdict:

Malicious

Tags:

quasarrat

YARA:

Quasar_RAT_1 pe_no_import_table INDICATOR_SUSPICIOUS_EXE_TelegramChatBot BrowserStealer INDICATOR_SUSPICIOUS_Binary_References_Browsers

Link:

https://app.threat.zone/submission/79351119-a1e1-4076-86da-7f80b0e586b2

Malware Family:

quasar

Malicious:

True

Tags:

file-overlay dotnet 64bit exe

Link:

https://intel.virussign.com/intelligence/file/bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff

Unpacked files

SH256 hash:

bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff

MD5 hash:

457013a94eefd116aeb5dd4762c3c44e

SHA1 hash:

b375573147ad807699ebc696fc35b01d0298c99d

Detections:

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Quasar_RAT_1

Link:

https://www.unpac.me/results/0491e989-5d1a-40ef-8454-e3ee7bb4ae6f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.72

Link:

https://yomi.yoroi.company/submissions/bfc5d48c6d67111d90eeeb6c69d1236f09c6bdfea94163e2af680e16a012a0ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot Create hunting rule
Author:	ditekSHen
Description:	Detects executables using Telegram Chat Bot

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Quasar_RAT_1 Create hunting rule
Author:	@SOCRadar
Description:	Detects Quasar RAT

Rule name:	Quasar_RAT_1_RID2B54 Create hunting rule
Author:	Florian Roth
Description:	Detects Quasar RAT
Reference:	https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TelegramAPIMalware_PowerShell_EXE Create hunting rule
Author:	@polygonben
Description:	Hunting for pwsh malware using Telegram for C2

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99141/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample