MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

QuasarRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421
SHA3-384 hash:	6afe0444c905d0e12d6d4779692490fce5fd0c47fbffab440f5bbd8f0863d1261268739df0626fda76e8fac4571f62f8
SHA1 hash:	5a72da1184a9646fb61cf86975745cbce83f2ff7
MD5 hash:	30a7cbaba112f77d734d122c9b32e19a
humanhash:	four-speaker-sodium-delaware
File name:	sample_credential.rar
Download:	download sample
Signature	QuasarRAT Create hunting rule
File size:	2'732 bytes
First seen:	2026-01-26 01:42:35 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	48:ZSQ2Ji3fi7iH+ayYFm7j3jvlatsD87NJ7VyFuAkOEcpNxclOkABAa7/7uXvJU9cq:ZSQd364ypgtlvV5AucpgABAICXvJU9Bl
TLSH	T1CE512B87B00EF040C233A87DC07FB6933A268E53E5FE24363160698F5FD2075525588E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	smica83
Tags:	CVE-2025-6218 CVE-2025-8088 rar

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:	sample_credential.txt:.._.._.._.._.._.._AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Startup_empty.vbs
File size:	1'058 bytes
SHA256 hash:	90812f09c872ba83891fae27c9513771eaa555c4d5900c83cf061c89d7bd16cc
MD5 hash:	50a71503fd29865dfa5a65935fbfbd60
MIME type:	text/plain
Signature	QuasarRAT

File name:	sample_credential.txt:Zone.Identifier
File size:	27 bytes
SHA256 hash:	d07777e0dc36ebecce3fa9644f0f44dc4a0b7ede0cbc1f5d33e8d6cb07af5b5c
MD5 hash:	c785c55d5fa3443a11b8417209c4b524
MIME type:	text/plain
Signature	QuasarRAT

File name:	sample_credential.txt
File size:	5'335 bytes
SHA256 hash:	a91a3166dc008557b8a0010aa786159ada06457b2f3af32fbdbe98789aa16192
MD5 hash:	b17cc00e8ab8ac2b7321a97a21fa6f92
MIME type:	text/plain
Signature	QuasarRAT

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/23bf8bcb-fefb-445f-971a-e5ea8b23314e/

Detection(s):

TwinWave.EvilRAR.GhettoSuperstream.20241120.UNOFFICIAL

TwinWave.EvilRAR.HongKongGarden_CVE-2025-8088.20250812.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6976c6c0bec9764f452ed9f9

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

repaired

Link:

https://www.filescan.io/uploads/6976c6bc55805a763ff597df/reports/d31a8719-7d4d-4322-867c-b5280396046b/overview

Verdict:

Malicious

Labled as:

CVE-2025-8088

Link:

https://www.hybrid-analysis.com/sample/d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421

Verdict:

Malicious

File Type:

rar

First seen:

2026-01-25T18:12:00Z UTC

Last seen:

2026-01-25T18:20:00Z UTC

Hits:

~10

Detections:

HEUR:Exploit.Multi.CVE-2025-6218.b HEUR:Exploit.Multi.CVE-2025-8088.gen HEUR:Exploit.Multi.CVE-2025-8088.b

Link:

https://opentip.kaspersky.com/d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/30a7cbaba112f77d734d122c9b32e19a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421/

Verdict:

Malicious

Threat:

CVE-2025-6218

Link:

https://tip.neiki.dev/file/d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421

Threat name:

Binary.Exploit.CVE-2025-8088

Status:

Malicious

First seen:

2026-01-25 21:08:59 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2w4zrshewkh2tqd5cnh44euimqfqbtzs22jv4ihhaneckrfjoqqq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260126-hc5szae18h/

Behaviour

Command and Scripting Interpreter: JavaScript

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d5b998c8e4b28fa9c07d134fce1288640b00cf32d6935e20e703482544a97421

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	SUSP_RAR_NTFS_ADS Create hunting rule
Author:	Proofpoint
Description:	Detects RAR archive with NTFS alternate data stream
Reference:	https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats

Rule name:	WinRAR_CVE_2025_8088_Exploit Create hunting rule
Author:	marcin@ulikowski.pl
Description:	Detects RAR archives exploiting CVE-2025-8088 in WinRAR
Reference:	https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/