MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a
SHA3-384 hash: 1f6028ffc123c1a7878806179f07db8461f39280a68fc456a1a6996152ae2628b122b5652e100cddb58c6c5ed10bacaa
SHA1 hash: f2e5fd035e9e3aa566ca70945b079291b7b668b6
MD5 hash: 1380ea6d83266e156d826fadc9aeeb76
humanhash: fruit-lamp-eight-fruit
File name:file
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:267'264 bytes
First seen:2025-11-21 13:44:51 UTC
Last seen:2025-11-22 23:58:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a5763d1f6dd0dbac191659bd8af41b8d (1 x QuasarRAT)
ssdeep 3072:aTnlxYtAj1/oDWtwn7w+uIjh2LkLIPZMEi2c+IqDXDy54GCM6H5CYmvCEwmyS5k8:yKWtUHBoLsI7rXj4sQryS5k8
Threatray 1'774 similar samples on MalwareBazaar
TLSH T175448D55B7E50CF9ED67853DCD824905EA72BC4647A0E7CF03A04AA61F236E09E3E712
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe fbf543 QuasarRAT


Avatar
Bitsight
url: http://178.16.55.189/files/6075866260/Zkx3Bhh.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
120
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Suspicious activity
Analysis date:
2025-11-21 13:45:26 UTC
Tags:
amsi-bypass evasion
Link:
https://app.any.run/tasks/d7ad5668-e2cf-4709-bd6c-ffe33bc1e7c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38940/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69206d004917b5d23db00947
Tags:
ransomware emotet remo hype
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP GET request
Creating a window
Searching for synchronization primitives
Сreating synchronization primitives
Sending a custom TCP request
DNS request
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm crypto explorer fingerprint lolbin microsoft_visual_cc
Link:
https://www.filescan.io/uploads/69206cfe6c89728b98252aa3/reports/71adbdd0-0835-458c-9b27-9fa3fe0b989d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-11-21T11:31:00Z UTC
Last seen:
2025-11-22T13:36:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Generic HEUR:Trojan.Multi.Donut.b Trojan.MSIL.Donut.sb Backdoor.MSIL.Agent.sb HEUR:Trojan-Banker.MSIL.ClipBanker.gen HEUR:Exploit.MSIL.BypassUAC.c HackTool.Multi.AmsiETWPatch.sb Trojan-PSW.MSIL.Agent.sb Trojan.Win64.Donut.sb Trojan.Win32.Shellcode.sb Trojan.MSIL.Agent.sb HEUR:Trojan.Win32.Agentb.gen Trojan-PSW.Multi.Stealer.sb Trojan.Win64.DonutInjector.sb Trojan.MSIL.Quasar.a MEM:Trojan.Win64.Shellcode.gen HEUR:Trojan.Win64.Donut.a Trojan.Win64.Agentb.sb MEM:Trojan.Win64.Shellcode.a MEM:Trojan.Win64.Cometer.gen
Link:
https://opentip.kaspersky.com/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/77bf8cd2-a7ec-4e5e-8450-856db87c4668
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/1380ea6d83266e156d826fadc9aeeb76
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-21 13:45:37 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3w4cqmihlqyuoqxdsexcpkdcqufmakzkm2j7566jiabzjiuhmafa._file
Verdict:
malicious
Label(s):
donutloader
Create hunting rule
quasarrat
Create hunting rule
Similar samples:
16cb7f5d34773d1f6d7348a5559e79c9d87b3c2f6c164bb3f306abe01a0e305e
QuasarRAT
18c6899051a3d07c23523c42a8ff0101434a17d39f9836990891bf476f59369d
QuasarRAT
33c1522c868fbe5ed4b88a3941523b22097e98d179a594171bc18a2eddfe991c
QuasarRAT
36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe
QuasarRAT
415c17f6478a1ae3396eee646a2025c9c531d25becb62dc460e2815fb5d34e07
QuasarRAT
54db44510d3c25894f89752c667b03e070863c5c86d15ff4c67f5f6564fb9091
QuasarRAT
8d551a15974c71c391d2e685c36db56ff37b3b4f65d29fb4385eb33556f21f17
QuasarRAT
c0c5bf845f1f796ca8d8f414206d501c36145d023e99c655567d44bcf96407ab
QuasarRAT
c626b732485b165b908b64835f0a2bb85d511b2e4f4c56dc29adecbb632a2dfe
QuasarRAT
c6e92bc1395d1865f41e0d10256f7de0fd6913a07c414b2489a191227b3730f6
QuasarRAT
error
QuasarRAT
+ 1'764 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:donutloader family:quasar botnet:shadow loader spyware trojan
Link:
https://tria.ge/reports/251121-q2njzssrdj/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Contains code to disable Windows Defender
Detects DonutLoader
DonutLoader
Donutloader family
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
205.209.99.112:8990
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/14954cc3-1686-4a8d-8cb9-2265f2f3b5c2
Unpacked files
SH256 hash:
ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a
MD5 hash:
1380ea6d83266e156d826fadc9aeeb76
SHA1 hash:
f2e5fd035e9e3aa566ca70945b079291b7b668b6
Link:
https://www.unpac.me/results/cc0ff790-bcd6-4d55-a4b2-a2166bd4b26a/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ddb82831075c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Executable exe ddb82831075c314742e3912e27a862850ac02b2a6693fefbc9400394a287600a

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/38940/
  
URLhaus
https://urlhaus.abuse.ch/url/3713522/

Comments