MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 38 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6
SHA3-384 hash: 4e8ffd69daf8aa3ed6f57772ead1fedf2bcebde60fa218d173ba9d13ad27477f154866cf477e7aecc4603919a8d33b32
SHA1 hash: 509b938cc18aadc1c0cb0dcfa27a50845837d13e
MD5 hash: 1e41d13dacd614db30c0627974e5f593
humanhash: california-indigo-alabama-april
File name:EnigmaHvH.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:37'655'199 bytes
First seen:2026-08-15 08:03:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4d0fb8dc9ee470058274f448bebbb85f (5 x ChromElevator, 4 x NodeLoader, 3 x Rhadamanthys)
ssdeep 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfb:fMguj8Q4VfvEqFTrYx
TLSH T14E878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon f89efcf8f971f2e0 (10 x NodeLoader, 9 x FixStealer, 6 x Amadey)
Reporter burger
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
SE SE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/d46583ab-3e81-4a08-8aa5-adac196ec2ca/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-08-15 08:08:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/73805c81-3c0a-4f7e-9688-3bef4bb3ea95

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Launching the process to interact with network services
Launching a process
Creating a file
Creating a file in the %temp% directory
Windows shutdown
Adding exclusions to Windows Defender
Enabling autorun by creating a file
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto expand fingerprint lolbin microsoft_visual_cc overlay packed pkg reconnaissance
Link:
https://www.filescan.io/uploads/6a801d5ffdc9e7749e96b42e/reports/094cf581-5540-483d-acb5-e0112f8d7bf3/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-08-15T05:05:00Z UTC
Last seen:
2026-08-16T00:43:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6/results?tab=lookup
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1958510
Signature
Adds extensions / path to Windows Defender exclusion list (Registry)
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Drops PE files with benign system names
Drops script or batch files to the startup folder
Encrypted powershell cmdline option found
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: System File Execution Location Anomaly
Sigma detected: Windows Binaries Write Suspicious Extensions
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Uses shutdown.exe to shutdown or reboot the system
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1958510 Sample: EnigmaHvH.exe Startdate: 15/08/2026 Architecture: WINDOWS Score: 100 58 ipwho.is 2->58 60 files.catbox.moe 2->60 68 Suricata IDS alerts for network traffic 2->68 70 Found malware configuration 2->70 72 Malicious sample detected (through community Yara rule) 2->72 74 12 other signatures 2->74 9 cmd.exe 1 2->9         started        12 EnigmaHvH.exe 4 2->12         started        15 svchost.exe 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 file5 84 Suspicious powershell command line found 9->84 86 Encrypted powershell cmdline option found 9->86 19 powershell.exe 14 19 9->19         started        23 conhost.exe 9->23         started        56 C:\Users\user\AppData\...\WindowsUpdate.bat, DOS 12->56 dropped 88 Drops script or batch files to the startup folder 12->88 25 cmd.exe 1 12->25         started        28 cmd.exe 1 12->28         started        30 cmd.exe 1 12->30         started        32 conhost.exe 12->32         started        signatures6 process7 dnsIp8 62 files.catbox.moe 108.181.20.35, 443, 49731 AS40676-PsychzNetworksUS United States 19->62 54 C:\Users\user\AppData\...\RuntimeBroker.exe, PE32 19->54 dropped 34 RuntimeBroker.exe 1 5 19->34         started        90 Encrypted powershell cmdline option found 25->90 38 powershell.exe 7 25->38         started        92 Suspicious powershell command line found 28->92 94 Uses shutdown.exe to shutdown or reboot the system 28->94 40 net.exe 1 28->40         started        42 shutdown.exe 1 30->42         started        file9 signatures10 process11 file12 52 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32 34->52 dropped 76 Antivirus detection for dropped file 34->76 78 Drops PE files with benign system names 34->78 80 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->80 44 svchost.exe 8 34->44         started        82 Powershell drops PE file 38->82 48 reg.exe 1 1 38->48         started        50 net1.exe 1 40->50         started        signatures13 process14 dnsIp15 64 193.161.193.99, 49732, 61894 GETWIFI-ASRU Russia 44->64 66 ipwho.is 104.20.44.133, 443, 49733 CLOUDFLARENET-CloudflareIncUS Canada 44->66 96 Antivirus detection for dropped file 44->96 98 System process connects to network (likely due to code injection or exploit) 44->98 100 Hides that the sample has been downloaded from the Internet (zone.identifier) 44->100 102 Adds extensions / path to Windows Defender exclusion list (Registry) 48->102 signatures16
Score:
84%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6
Gathering data
Threat name:
Win64.Trojan.LShot
Create hunting rule
Status:
Malicious
First seen:
2026-08-15 08:05:54 UTC
File Type:
PE+ (Exe)
Extracted files:
12
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3x47gp6ddc6jd3vjjjaenixqhu3gkicxxhiplomfz2a44qdbytta._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
execution persistence privilege_escalation
Link:
https://tria.ge/reports/260815-jx3d1seg47/
Behaviour
Modifies data under HKEY_USERS
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Creates a file in the Startup directory
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ddf9f33fc318/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddf9f33fc318bc91eea94a4046a2f03d36652057b9d0f5b985ce81ce4061c4e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202409_html_FedEx_phish
Create hunting rule
Author:abuse.ch
Description:Detects potential HTML FedEx phishing forms
Rule name:APT_Bitter_ZxxZ_Downloader
Create hunting rule
Author:SECUINFRA Falcon Team (@SI_FalconTeam)
Description:Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh
Rule name:attack_India
Create hunting rule
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:EXE_Unknown_Byakugan_April2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:skip20_sqllang_hook
Create hunting rule
Author:Mathieu Tartare <mathieu.tartare@eset.com>
Description:YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:https://www.welivesecurity.com/
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
Rule name:Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026
Create hunting rule
Author:SixHands
Description:Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments