MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6
SHA3-384 hash: 89b795abd00fb3b9324aff8b23cee67a5ec4f1cf89be71702cbe07945fd57e70ad5d78d9ec6639058a3691829160a5c4
SHA1 hash: 444fc14b2df81d67dfc9594e63c9f02cdd17185f
MD5 hash: 7a30f2d2bba350579d531068adb70360
humanhash: december-ohio-william-rugby
File name:7a30f2d2bba350579d531068adb70360.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:890'880 bytes
First seen:2025-06-27 13:19:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:MSYuV9/3qXCnfv9DkiJiKrPZtSaWhV/2D2AfDpfrgOWAVAf60jSXzYvJJ+MlSR:MStnCXCSicKrL4F2D2AfDpfrHd0jRhZ
TLSH T10C15234B3FF9C590C268E939A8694685233EE214765383F72FC8D51D2C567EB3C892C6
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe QuasarRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
441
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7a30f2d2bba350579d531068adb70360.exe
Verdict:
Malicious activity
Analysis date:
2025-06-27 13:24:38 UTC
Tags:
crypto-regex
Link:
https://app.any.run/tasks/4f5102bc-2a2d-4463-bbf3-db802a255012

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/11363/
Detection(s):
Win.Packed.njRAT-10019521-0
Create hunting rule

Win.Packed.QuasarRAT-10027234-0
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685e9aaa37c3436779468dab
Tags:
keylog virus remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Connection attempt
Setting a keyboard event handler
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 cryptor_detected crypto_obfuscator_for_net njrat obfuscated packed packed
Link:
https://www.filescan.io/uploads/685e9aa7d1f1eb5d81c885e4/reports/7e528cb9-fe8d-4a88-b321-7e60f9cc9b41/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8589ff8b-e7f0-4331-aa15-dc9679ca172c
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1724183
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/7a30f2d2bba350579d531068adb70360
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-06-22 21:14:15 UTC
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4iwuadyzw4xtdvysz4xrgoatx6pywiip6qie6zcaaj7cv2upfdta._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250627-qlb61sgk7y/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Verdict:
Malicious
Tags:
Win.Packed.njRAT-10019521-0
YARA:
n/a
Link:
https://app.threat.zone/submission/a8f914bb-ac04-47b8-ab35-09f1f9141270
Unpacked files
SH256 hash:
e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6
MD5 hash:
7a30f2d2bba350579d531068adb70360
SHA1 hash:
444fc14b2df81d67dfc9594e63c9f02cdd17185f
Link:
https://www.unpac.me/results/e7b5245e-619e-45a6-8a6e-4ceb82f578eb/
SH256 hash:
8aebd4871543ce5b5dbe4af7b02af0c019ef21643e2318effd2777c538ee4d20
MD5 hash:
470243cf014a5052b7aa7025332bc9f6
SHA1 hash:
159fb9bcf941be590a09dccfa10067650789086d
Link:
https://www.unpac.me/results/e7b5245e-619e-45a6-8a6e-4ceb82f578eb/
SH256 hash:
b73fc89da617c7a54029c26a2bd9c7367ead9f8470cb2110adc7ae4d695abcfc
MD5 hash:
fbd4556deec70fccb59138785c50b03b
SHA1 hash:
a1c4e552f2e9b6f7210f2b693820d972302bd655
Detections:
INDICATOR_EXE_Packed_Fody
Create hunting rule
Link:
https://www.unpac.me/results/e7b5245e-619e-45a6-8a6e-4ceb82f578eb/
SH256 hash:
9c8fd1531f5fffd5caefa9c7a7aae03bf555684332cbf6b1095aaea22bdceb07
MD5 hash:
5afacee77d899ce63573d0536351395f
SHA1 hash:
ae3ea613f93a17d4e74febaa33a7ee176e77df5c
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
HKTL_NET_GUID_Quasar
Create hunting rule
Link:
https://www.unpac.me/results/e7b5245e-619e-45a6-8a6e-4ceb82f578eb/
SH256 hash:
38395717f48e1e64bd29c6cb5df11349f011cae5f9fce0264b53252d60cdd191
MD5 hash:
38be3b238310387bb5fa85a999326277
SHA1 hash:
b927071b902b777cda7e52a6f79af9cba1c62fdc
Link:
https://www.unpac.me/results/e7b5245e-619e-45a6-8a6e-4ceb82f578eb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e22d400f19b72f31d712cf2f133813bf9f8b210ff4104f6440027e2aea8f28e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11363/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments