MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 19


Intelligence 19 IOCs YARA 29 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271
SHA3-384 hash: 7896fed9b73eb05efcc38657893c338fc68fab6a92b69bf83d131491072f286fbc7e09871f25d6c7fecad3597cae94e2
SHA1 hash: 6e8964bcff3dd00587fc84a5a739141eb3553c09
MD5 hash: 2a034511446d3f8360c14a91b47777c2
humanhash: early-west-winner-comet
File name:svchost.exe
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:5'664'256 bytes
First seen:2025-09-01 22:07:15 UTC
Last seen:2025-09-02 13:08:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 49152:utLtG52BLdnc8ImhHy69ztxaY5lyni2DBZKe8taaY5lSni2DBZWLV7wRd7IoBG6F:utLE5kLdnjZdyeJH6O1MJKm77LrwkFW
TLSH T138467B06F7F210D1F5BBC279A4A73129BD3674A14B38D7CB52845A8E1B31BE4AD39702
TrID 58.8% (.RLL) Microsoft Resource Library (x86) (177572/6/26)
24.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
5.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.4% (.EXE) Win64 Executable (generic) (10522/11/4)
2.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika pebin
Reporter smica83
Tags:exe manual-terminology-gl-at-ply-gg QuasarRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
72
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
svchost.exe
Verdict:
Malicious activity
Analysis date:
2025-09-01 22:10:22 UTC
Tags:
crypto-regex
Link:
https://app.any.run/tasks/a7003f29-0be1-4111-8209-14679ca18252

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
R77
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24615/
Detection(s):
Win.Malware.Generic-9883083-0
Create hunting rule

Win.Malware.Bulz-9933026-0
Create hunting rule

Win.Packed.Barys-10003703-0
Create hunting rule

Win.Packed.Lazy-10019086-0
Create hunting rule

ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL
Create hunting rule

Win.Malware.Generic-6623004-0
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b6192beb163e0ec18419d5
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Connection attempt to an infection source
Query of malicious DNS domain
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm anti-vm base64 cmd cscript dllhost explorer fingerprint lolbin lolbin mshta obfuscated packed privilege reconnaissance runonce schtasks threat update
Link:
https://www.filescan.io/uploads/68b6192739a6221faa7942ce/reports/1f283bbc-e340-441a-a71c-0b89cdcac54e/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-01T16:51:00Z UTC
Last seen:
2025-09-01T16:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/16f1b10d-22a2-42a5-84a2-7f8ae885b389
Result
Threat name:
Quasar
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1769128
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Connects to many ports of the same IP (likely port scanning)
Contains functionality to disable the Task Manager (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Quasar RAT
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271
Verdict:
QuasarRat
YARA:
15 match(es)
Tags:
.Net Executable Fody/Costura Packer Html Malicious Managed .NET PDB Path PE (Portable Executable) PE File Layout QuasarRat RAT SOS: 0.14 SOS: 0.15 SOS: 0.18 SOS: 0.19 SOS: 0.20 SOS: 0.22 SOS: 0.23 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.29 SOS: 0.32 SOS: 0.34 SOS: 0.35 SOS: 0.61 Win 32 Exe x86
Link:
https://app.malva.re/file/2a034511446d3f8360c14a91b47777c2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271/
Threat name:
ByteCode-MSIL.Backdoor.Quasar
Create hunting rule
Status:
Malicious
First seen:
2025-09-01 21:47:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7cituuy6xu62rtkeykzosavdio7o7qtvy3sorwqqb6xpysb5mjyq._file
Verdict:
malicious
Label(s):
r77rootkit
Create hunting rule
quasarrat
Create hunting rule
Similar samples:
error
QuasarRAT
Result
Malware family:
quasar
Create hunting rule
Score:
  10/10
Tags:
family:quasar botnet:office04 spyware trojan
Link:
https://tria.ge/reports/250901-11va9axygy/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Quasar RAT
Quasar family
Quasar payload
Malware Config
C2 Extraction:
manual-terminology.gl.at.ply.gg:59071
Verdict:
Malicious
Tags:
rootkit rat quasar_rat trojan Win.Malware.Generic-9883083-0
YARA:
Windows_Rootkit_R77_99050e7d MAL_QuasarRAT_May19_1 malware_windows_quasarrat MALWARE_Win_R77
Link:
https://app.threat.zone/submission/ad9271f1-40b2-4704-a12f-b45df35e3a07
Unpacked files
SH256 hash:
f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271
MD5 hash:
2a034511446d3f8360c14a91b47777c2
SHA1 hash:
6e8964bcff3dd00587fc84a5a739141eb3553c09
Detections:
QuasarRAT
Create hunting rule
r77Rootkit
Create hunting rule
r77RootkitStager
Create hunting rule
Link:
https://www.unpac.me/results/a2324619-8b28-484c-aecb-1e1e049aa4ee/
SH256 hash:
b0652a7c788160f212e24e7e9db5a47d8c48a963c70cf2976c5e0defea4ee4f1
MD5 hash:
c691b6b6d95a4da77b84aa4e9b4332c7
SHA1 hash:
b30d3e8dd85ddf59f88cca228c67607ddd12d44a
Detections:
r77Rootkit
Create hunting rule
MALWARE_Win_R77
Create hunting rule
Link:
https://www.unpac.me/results/a2324619-8b28-484c-aecb-1e1e049aa4ee/
SH256 hash:
8fdae5b4490183c9057a684f0ac2f82dd5c8911cb2f43a54ff47a9ad6e93952a
MD5 hash:
d72fea64a05b3f7dce725352d7c1d032
SHA1 hash:
9c27e234567d237d9c495353567f2efa42e8f616
Detections:
r77RootkitStager
Create hunting rule
Link:
https://www.unpac.me/results/a2324619-8b28-484c-aecb-1e1e049aa4ee/
Parent samples :
8fdae5b4490183c9057a684f0ac2f82dd5c8911cb2f43a54ff47a9ad6e93952a
e2822abbdcd990bd187506aba7f44d2b5f0c28e526f12baa1fddfdcdeecf19b4
f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271
SH256 hash:
4350a69f2630214a7b079e41e3ac2d7c5759a622a0cd1227ba12eee06d758d9a
MD5 hash:
56561903fd1e9dedfe029dd8c9172e7c
SHA1 hash:
ca2fbcd301d4e1ddb3e7fd2b53099e12c06e48c6
Detections:
r77Rootkit
Create hunting rule
r77RootkitStager
Create hunting rule
MALWARE_Win_R77
Create hunting rule
Link:
https://www.unpac.me/results/a2324619-8b28-484c-aecb-1e1e049aa4ee/
SH256 hash:
2a55b2edd020f1821fcb4028869fe72571910263188972ff1c7bbd927da447f5
MD5 hash:
7d8211adade9592055afcb6dac7add4f
SHA1 hash:
aeae897d5052e08a63e68b93ddf9ee45904a2272
Detections:
r77Rootkit
Create hunting rule
MALWARE_Win_R77
Create hunting rule
Link:
https://www.unpac.me/results/a2324619-8b28-484c-aecb-1e1e049aa4ee/
Malware family:
QuasarRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f8913a531ebd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:Check_Dlls
Create hunting rule
Rule name:Costura_Protobuf
Create hunting rule
Author:@bartblaze
Description:Identifies Costura and Protobuf in .NET assemblies, respectively for storing resources and (de)serialization. Seen together might indicate a suspect binary.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:MALWARE_Win_R77
Create hunting rule
Author:ditekSHen
Description:Detects r77 rootkit
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Description:Detects QuasarRAT malware
Rule name:MAL_QuasarRAT_May19_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:MAL_QuasarRAT_May19_1_RID2E1E
Create hunting rule
Author:Florian Roth
Description:Detects QuasarRAT malware
Reference:https://blog.ensilo.com/uncovering-new-activity-by-apt10
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Rootkit_R77_99050e7d
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuasarRAT

Executable exe f8913a531ebd3da8cd44c2b2e902a343beefc275c6e4e8da100faefc483d6271

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/24615/

Comments