MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
QuasarRAT
Vendor detections: 15
| SHA256 hash: | ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc |
|---|---|
| SHA3-384 hash: | 90c05e0b6d437103caf0d09a0f84669dddf9c092b425730874a5c226d1601f5d374133da232a3fa641e14edf9eee9941 |
| SHA1 hash: | ba5bda33d15a5cb5e1d8e850a5a28b0ed03a9c34 |
| MD5 hash: | 00faadbd39a1aaabf35b789222110d80 |
| humanhash: | tennis-cardinal-juliet-cup |
| File name: | 00faadbd39a1aaabf35b789222110d80.exe |
| Download: | download sample |
| Signature | QuasarRAT |
| File size: | 3'146'240 bytes |
| First seen: | 2026-04-09 05:43:07 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'859 x AgentTesla, 19'785 x Formbook, 12'305 x SnakeKeylogger) |
| ssdeep | 49152:k+iNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRkx6Z:eNgScVIxpLlwZNnAKSb7L3w0Xe |
| Threatray | 198 similar samples on MalwareBazaar |
| TLSH | T181E5D02039EA401EF1B7AF75DBD4B4DA9A6EF263370AA65D144103464E23B41EEC713E |
| TrID | 60.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 13.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 5.4% (.EXE) Win64 Executable (generic) (6522/11/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| Reporter |  abuse_ch |
| Tags: | exe QuasarRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
111
Origin country :
SEVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
00faadbd39a1aaabf35b789222110d80.exe
Verdict:
Malicious activity
Analysis date:
2026-04-09 05:45:11 UTC
Tags:
pulsar rat crypto-regex
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.1%
Tags:
emotet proxy
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Setting a keyboard event handler
DNS request
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm base64 hacktool obfuscated overlay packed packed privilege quasar reconnaissance redline unsafe
Verdict:
Malicious
Labled as:
Malware.Generic
Result
Gathering data
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-05T14:29:00Z UTC
Last seen:
2026-04-06T08:02:00Z UTC
Hits:
~10
Detections:
HEUR:HackTool.Win64.Disabler.gen Trojan-PSW.MSIL.Agent.sb Trojan-Banker.MSIL.BitStealer.gen HEUR:Trojan.Win32.Convagent.gen Backdoor.MSIL.PulsarRAT.sb Trojan-Banker.MSIL.ClipBanker.sb HEUR:Trojan.MSIL.R77.gen HEUR:HackTool.Win64.Disabler.pefng NetTool.Ngrok.UDP.C&C
Verdict:
Malicious
Result
Threat name:
Quasar
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Verdict:
Malicious
Threat:
Family.PULSARRAT
Threat name:
Win32.Backdoor.PulsarRat
Status:
Malicious
First seen:
2026-04-05 19:26:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
28 of 36 (77.78%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
quasarrat
Similar samples:
+ 188 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Contacts third-party web service commonly abused for C2
Unpacked files
SH256 hash:
ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc
MD5 hash:
00faadbd39a1aaabf35b789222110d80
SHA1 hash:
ba5bda33d15a5cb5e1d8e850a5a28b0ed03a9c34
SH256 hash:
32ddcc8ec426baf56816514447c6cef2ef81b20b145946e7533401d3eb0ca929
MD5 hash:
ff508c605092d6aaf88651c4406162fb
SHA1 hash:
6986dd0dc239754ae457da779f065d70335190a5
SH256 hash:
529d219ef85acea126cd6b48803c339cc1e15daf583d79bafc2d626d42fa678b
MD5 hash:
9795ce8d12a06ed15107f48e8167f1b6
SHA1 hash:
0dc18a46aed9fc91137c99de6c60d709b588373e
SH256 hash:
859fe4442e54e6fb6d46e0a76a9e523f0f014f66f83957c619c263b8479eccf0
MD5 hash:
84168641e085bf92a7445515a85b3a65
SHA1 hash:
1086d9c163aa91d8560ef21dcb4d10a66081ba17
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
SH256 hash:
4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 hash:
50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 hash:
3e296ec3bb24750833ea80515e6fb4c73874c91a
SH256 hash:
f4797211fe3ddc3877fe7286a344184e39cc0c7e2744eba1a4921b844cf8779e
MD5 hash:
eb9cd7d54078658c4f048a5be4273eda
SHA1 hash:
7ed68a247700ced0bd75b2e5e4e62677e7c912ba
SH256 hash:
1c1a49dc957ade033bd60dca58db3cc2221bd71bab7a20ab4f5009e98f13ff29
MD5 hash:
a70c5dc135347dde470f1e5b7edb4411
SHA1 hash:
e85c560a6aa24e2c64ad2a74b995a7316e8e8958
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
HKTL_NET_GUID_Quasar
Parent samples :
9382df4bc0f53192bd444266bac725b836d3633942fbbf617648536e449cf39e
acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
93ae860b34d78429fd3f4140cb2ca139bed29fa0f81d99cd35dce8f8024b0f0a
7e076c82e891f6cc0bff69929c87259a24380b2cfbd893330d68174140aab3a1
ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc
acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d
93ae860b34d78429fd3f4140cb2ca139bed29fa0f81d99cd35dce8f8024b0f0a
7e076c82e891f6cc0bff69929c87259a24380b2cfbd893330d68174140aab3a1
ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Costura_Protobuf |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies Costura and Protobuf in .NET assemblies, respectively for storing resources and (de)serialization. Seen together might indicate a suspect binary. |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerHiding__Thread |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_EXE_Packed_Fody |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables manipulated with Fody |
| Rule name: | Indicator_MiniDumpWriteDump |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Pulsar_RAT |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies Pulsar RAT, based on Quasar RAT. |
| Reference: | https://malpedia.caad.fkie.fraunhofer.de/details/win.pulsar_rat |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.