MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477
SHA3-384 hash: cf5609c346fb2b2426ecd6b8d8e37155538c5aa71dc17b0b0f4a5837c382d9785ff89d28a05fb9f05325605596539e1c
SHA1 hash: 407e1c738410211ecb19288c3d21c2cbba6f0a5b
MD5 hash: 2196ad6dcdc885b5d196698e9784bd45
humanhash: april-music-april-tango
File name:PZ-Reversals.ps1
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:2'804 bytes
First seen:2026-03-04 12:23:52 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:fPfe4mDgrTXj30um1eQJxWyyl2zxUj9avwNdepW7gmyWoOWLw6AUjw0:f42EuwvM/8tU8GdqE0/Oswyf
Threatray 28 similar samples on MalwareBazaar
TLSH T17B51A5A53F43E8A98465B114D9D74289FDA890BD300B661071E44F1DFEF8CBA837D48C
Magika powershell
Reporter JAMESWT_WT
Tags:91-124-98-29 github-com--evilgrou-tech ps1 QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69a8247d002d37d5c98398c3
Tags:
shell sage remo
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/69a8247a97feb4afd66964f0/reports/2ca15f0a-597c-4c38-9294-5da691930363/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477
Result
Gathering data
Verdict:
Adware
File Type:
ps1
Detections:
NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C
Link:
https://opentip.kaspersky.com/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477/results?tab=lookup
Score:
80%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477
Verdict:
Malware
YARA:
2 match(es)
Tags:
DeObfuscated PowerShell
Link:
https://app.malva.re/file/2196ad6dcdc885b5d196698e9784bd45
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477/
Verdict:
Malicious
Threat:
Family.QUASAR
Link:
https://tip.neiki.dev/file/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27vzrren3gd3jmeogob63kgks4ncgh7tplq5zfk26ev2gmoymr3q._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
299f253ef5a0f06b347cdfeab309c849cf7951a227ed4c13efb61ddf48c1c8e5
QuasarRAT
319105f81849eaea316dbbdf2b41c102eee1d374ad6d2b6ac9c8245e5a18d0aa
QuasarRAT
57f2ac5bede8fbd133b245c70f1f5aa09277cc735c55b1aece5cdc47b92060eb
QuasarRAT
74f095f2b5f575720fa634777740f4856468a0c008ba8e78b2d53738b205dc46
QuasarRAT
b80ac13edccd2ca442221d7b22a6e8c7eb98688426582d38bf4ebbd5e0ab265b
QuasarRAT
error
QuasarRAT
+ 18 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:office04 execution persistence spyware trojan
Link:
https://tria.ge/reports/260304-pk8m6ahz4j/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Contacts third-party web service commonly abused for C2
Deletes itself
Executes dropped EXE
Badlisted process makes network request
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
91.124.98.29:2525
Dropper Extraction:
https://github.com/evilgrou-tech/drive/raw/refs/heads/main/OneDriveSetup.dat
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d7eb98c48dd9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:WIN_ClickFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:ClickFix social engineering and malicious PowerShell commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

PowerShell (PS) ps1 d7eb98c48dd987b4b08e3383eda8ca971a231ff37ae1dc955af12ba331d86477

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3789480/
  
Delivery method
Distributed via web download

Comments