MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d4d817b58a12f35048260a01358b2cf936bb2345c2860b2cb887bd554cd3b476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
QuasarRAT
Vendor detections: 12
| SHA256 hash: | d4d817b58a12f35048260a01358b2cf936bb2345c2860b2cb887bd554cd3b476 |
|---|---|
| SHA3-384 hash: | 02419bb4c4bbf872f193035031024e4d32aaa8ab94643fc232b1ee3102e429766448b5d24fc1df497b20840c8a1d94ad |
| SHA1 hash: | cbf459de3a3b17cab2603e569a4f7dd7c9db83a0 |
| MD5 hash: | 3fd263909c28d212f0dc65beeea55a7c |
| humanhash: | muppet-autumn-mexico-mike |
| File name: | Ovthjp.exe |
| Download: | download sample |
| Signature | QuasarRAT |
| File size: | 3'574'784 bytes |
| First seen: | 2025-07-16 04:51:44 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'241 x AgentTesla, 20'496 x Formbook, 12'373 x SnakeKeylogger) |
| ssdeep | 98304:KDAnKxzMqiUlhNV6iAgXJ0nRMVq4g5hMUmM:KfxzfiWhN1AgZ0n2VHaBB |
| Threatray | 497 similar samples on MalwareBazaar |
| TLSH | T1A8F5228127ECCA19F2FE2BB5B831A0524BB5F946A4BEC75D4D8860DD1C22B184E5137F |
| TrID | 66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.5% (.EXE) Win64 Executable (generic) (10522/11/4) 5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.0% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  JAMESWT_WT |
| Tags: | booking ClickFix exe FakeCaptcha PureHVNC QuasarRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
126
Origin country :
ITVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ovthjp.exe
Verdict:
Malicious activity
Analysis date:
2025-07-16 04:55:44 UTC
Tags:
auto-startup stealer netreactor purehvnc
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
90.2%
Tags:
autorun dotnet micro smtp
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %AppData% directory
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt
Sending a custom TCP request
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 expand lolbin packed reconnaissance
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Verdict:
Unknown
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable PE (Portable Executable) SOS: 0.02 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Trojan.Seraph
Status:
Malicious
First seen:
2025-07-16 04:52:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
23 of 37 (62.16%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
resolverrat
Similar samples:
+ 487 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
d4d817b58a12f35048260a01358b2cf936bb2345c2860b2cb887bd554cd3b476
MD5 hash:
3fd263909c28d212f0dc65beeea55a7c
SHA1 hash:
cbf459de3a3b17cab2603e569a4f7dd7c9db83a0
SH256 hash:
cf82929cf737b33b319eb6df25faea8875a602eb8e18fed0e49e529088a585a1
MD5 hash:
fca227e4b6077333eee59a5a0d2a160d
SHA1 hash:
00551e2329a7f0fb057a3a581bc5d6621eb29b8d
SH256 hash:
3b46b80514f71e2524236fcba5670c791f5fe1538837b48895189cc4560e5e37
MD5 hash:
a3cf18f25120ea343fe9f9a0ee966260
SHA1 hash:
d21570971db4a42609a264544d39a26a8b3a73fe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | botnet_plaintext_c2 |
|---|---|
| Author: | cip |
| Description: | Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols. |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.