MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 22


Intelligence 22 IOCs YARA 30 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
SHA3-384 hash: f97055846b633fa2a79ac8ad114d7d08f4e7d3100c76d64d788c2990f649332969fb6067b1f8c2f5139819cace8a595a
SHA1 hash: c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d
MD5 hash: c7621bd824231ada140d61c4abfb61bc
humanhash: one-batman-magazine-wyoming
File name:Comprobante.Transferencia.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:850'944 bytes
First seen:2025-12-05 14:36:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'075 x AgentTesla, 20'033 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 12288:NTUJVLlMl/WJbWlsZ3A8O/SloAS5M2YQ0mlriPkEywNS1CjJj+OLJYUm:NQJbMl/WJ4sZvfRSimiP8wNe8j+OL+
Threatray 767 similar samples on MalwareBazaar
TLSH T1150502DD3690A5FFC427D47189659D34E2626C7B0707D203A46B3C9FB63E5CB8E248A2
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon f0c0db6c6a7af0fc (24 x Formbook, 12 x QuasarRAT, 5 x RemcosRAT)
Reporter cocaman
Tags:exe payment QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
ConfuserEx
Details
ConfuserEx
decrypted strings and possibly embedded components
Link:
https://research.acce.ciphertechsolutions.com/results/19415a3e-0576-42c6-a3d3-97f26ab4f99e/
Malware family:
quasar
Create hunting rule
ID:
1
File name:
Comprobante.Transferencia.exe
Verdict:
Malicious activity
Analysis date:
2025-12-05 14:37:01 UTC
Tags:
quasar rat auto-reg evasion remote
Link:
https://app.any.run/tasks/c96230a3-ebd8-4f7c-abe9-8ec5a2cf0bbf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
QuasarRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42660/
Detection(s):
Win.Packed.Lynx-6899009-0
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6932ede75fbc58ad9e749559
Tags:
autorun micro shell sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 lynx obfuscated obfuscated packed vbnet
Link:
https://www.filescan.io/uploads/6932ee1dff25e40750d4d57a/reports/365f25f0-4ba8-4e4d-8676-79c3dbb68b73/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-05T07:03:00Z UTC
Last seen:
2025-12-06T14:36:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.Win32.Generic Trojan-Spy.Quasar.HTTP.ServerRequest PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6/results?tab=lookup
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/296b50f7-4803-46da-b35f-58cffd40e95c
Result
Threat name:
Quasar, XRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1827294
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Quasar RAT
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Quasar RAT
Yara detected XRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1827294 Sample: Comprobante.Transferencia.exe Startdate: 05/12/2025 Architecture: WINDOWS Score: 100 55 uortyfivev.crabdance.com 2->55 57 shed.dual-low.part-0013.t-0009.t-msedge.net 2->57 59 6 other IPs or domains 2->59 63 Suricata IDS alerts for network traffic 2->63 65 Found malware configuration 2->65 67 Malicious sample detected (through community Yara rule) 2->67 69 11 other signatures 2->69 11 Comprobante.Transferencia.exe 1 2->11         started        15 Comprobante.Transferencia.exe 2->15         started        signatures3 process4 file5 51 C:\...\Comprobante.Transferencia.exe.log, ASCII 11->51 dropped 79 Detected unpacking (changes PE section rights) 11->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 11->81 83 Injects a PE file into a foreign processes 11->83 17 Comprobante.Transferencia.exe 15 4 11->17         started        22 Comprobante.Transferencia.exe 2 11->22         started        24 Comprobante.Transferencia.exe 15->24         started        26 Comprobante.Transferencia.exe 15->26         started        signatures6 process7 dnsIp8 53 ip-api.com 208.95.112.1, 49718, 49719, 80 TUT-ASUS United States 17->53 49 C:\Users\user\AppData\Roaming\...\apiac.exe, PE32 17->49 dropped 71 Detected Quasar RAT 17->71 73 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->73 28 apiac.exe 1 17->28         started        31 schtasks.exe 1 17->31         started        33 WerFault.exe 26->33         started        file9 signatures10 process11 signatures12 85 Antivirus detection for dropped file 28->85 87 Multi AV Scanner detection for dropped file 28->87 89 Injects a PE file into a foreign processes 28->89 35 apiac.exe 14 2 28->35         started        39 apiac.exe 28->39         started        41 conhost.exe 31->41         started        process13 dnsIp14 61 uortyfivev.crabdance.com 195.24.236.68, 49721, 61541 NTI-AS9MaiBlocB11ScaraDEtaj2Ap67RO Romania 35->61 75 Detected Quasar RAT 35->75 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->77 43 schtasks.exe 1 35->43         started        45 WerFault.exe 2 39->45         started        signatures15 process16 process17 47 conhost.exe 43->47         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
Verdict:
inconclusive
YARA:
12 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.85 Win 32 Exe x86
Link:
https://app.malva.re/file/c7621bd824231ada140d61c4abfb61bc
Detection:
quasar
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6/
Verdict:
Malicious
Threat:
Family.QUASAR
Link:
https://tip.neiki.dev/file/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
Threat name:
ByteCode-MSIL.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2025-12-05 10:05:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ccoqcv7fyj2al4omekanjez7us7zpmesuoktp7wf5zmncl4wtla._file
Verdict:
malicious
Label(s):
quasarrat
Create hunting rule
Similar samples:
268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a
QuasarRAT
4090ddde1d1ffb846bd2acf0e0f6b355ea151e0b38c33f029049ac6e93919043
QuasarRAT
7d2f2b6ca631ed873d69839d81742302f35de670847eb7de4622562e538fdd20
QuasarRAT
e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
QuasarRAT
error
QuasarRAT
fdb7865b933ca403988dfa5e9b5bc1a7b119d4ba015f984799f2ab9c9c05fe41
QuasarRAT
+ 757 additional samples on MalwareBazaar
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:flow2 discovery execution persistence spyware trojan
Link:
https://tria.ge/reports/251205-ryr9fahs3c/
Behaviour
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Looks up external IP address via web service
Executes dropped EXE
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
uortyfivev.crabdance.com:61541
flowbilding.ydns.eu:61542
Verdict:
Malicious
Tags:
Win.Packed.Lynx-6899009-0 AZORult Qasar_Rat VoidRat External_IP_Lookup
YARA:
n/a
Link:
https://app.threat.zone/submission/8a928755-01ef-40d1-849c-c7e5442ea366
Unpacked files
SH256 hash:
e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
MD5 hash:
c7621bd824231ada140d61c4abfb61bc
SHA1 hash:
c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d
Link:
https://www.unpac.me/results/e379d15c-1466-4fd6-9ad0-fd34ec7228b2/
SH256 hash:
91e0aab5418134dbd6168a6743243537dc7af21ea0674aab62974cb0a07f7db7
MD5 hash:
e49497a3bd597360596bb077a89c580b
SHA1 hash:
25fbbea28014112c0b753d3725d914ed80559f60
Detections:
QuasarRAT
Create hunting rule
cn_utf8_windows_terminal
Create hunting rule
malware_windows_xrat_quasarrat
Create hunting rule
Quasar_RAT_1
Create hunting rule
Quasar_RAT_2
Create hunting rule
MAL_QuasarRAT_May19_1
Create hunting rule
Vermin_Keylogger_Jan18_1
Create hunting rule
xRAT_1
Create hunting rule
CN_disclosed_20180208_KeyLogger_1
Create hunting rule
win_quasarrat_j1
Create hunting rule
Quasar
Create hunting rule
win_quasar_rat_client
Create hunting rule
INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_QuasarRAT
Create hunting rule
Link:
https://www.unpac.me/results/e379d15c-1466-4fd6-9ad0-fd34ec7228b2/
SH256 hash:
50df10f74bc030c856fb8e443a86ebba06a46553052902e68b0b85f12f871fc5
MD5 hash:
ac9da123b818865682e30ac93c87debc
SHA1 hash:
58b57ea9cf79328e1518b086d080f2158af4c3eb
Link:
https://www.unpac.me/results/e379d15c-1466-4fd6-9ad0-fd34ec7228b2/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e084e80abf2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CN_disclosed_20180208_KeyLogger_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:CN_disclosed_20180208_KeyLogger_1_RID3227
Create hunting rule
Author:Florian Roth
Description:Detects malware from disclosed CN malware set
Reference:https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifacts observed in infostealers
Rule name:malware_Quasar_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:MALWARE_Win_QuasarRAT
Create hunting rule
Author:ditekSHen
Description:QuasarRAT payload
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Quasar
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect QuasarRAT in memory
Rule name:quasarrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:quasarrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Quasar_RAT_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_1_RID2B54
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:Quasar_RAT_2_RID2B55
Create hunting rule
Author:Florian Roth
Description:Detects Quasar RAT
Reference:https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Vermin_Keylogger_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Vermin Keylogger
Reference:https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/
Rule name:Windows_Trojan_Quasarrat_e52df647
Create hunting rule
Author:Elastic Security
Rule name:win_quasar_rat_client
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in Quasar Rat Samples.
Rule name:xRAT_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W
Rule name:xRAT_1_RID2900
Create hunting rule
Author:Florian Roth
Description:Detects Patchwork malware
Reference:https://goo.gl/Pg3P4W

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar 87c95139e2dc89f96b0bef969bd71588ab9a65f6aed139fb25a09a14b4af5fa9

QuasarRAT

Executable exe e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 87c95139e2dc89f96b0bef969bd71588ab9a65f6aed139fb25a09a14b4af5fa9
  
Dropped by
MD5 6651b284c571e1f511e190cf167687b0
Cape
Cape
https://www.capesandbox.com/analysis/42660/

Comments