MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552
SHA3-384 hash:	2d319c2e71ba36b8c1c27060ccc81e7d33dab78ed497363df32ca601cd89a8632035e5e2205c7463389cec6c49a7bf0a
SHA1 hash:	150e895fbf2085222dd76c2ef6595a4b04be1761
MD5 hash:	f4cc54763cbf0494510742590b799d5c
humanhash:	november-alaska-bulldog-orange
File name:	42x9ht_aporia.exe
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	87'252'480 bytes
First seen:	2025-10-26 22:16:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	00097805748014a0566196bbe0e1e104 (1 x QuasarRAT)
ssdeep	393216:CQ4X85BIoQkg6NJXjN/yNDyAV5qWEpgC7WsZtR2RKrkcN9TZLQcgMek3XReVz/bB:Ch1UMqWKTe1HDb2HbUpnf8RRtgPdBsc
TLSH	T16C188D4253AA09D5EAFBEA3485E65D03D773FC062B3881CF72481B261F336E09976B51
TrID	49.9% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.6% (.EXE) OS/2 Executable (generic) (2029/13) 9.5% (.EXE) Generic Win/DOS Executable (2002/3) 9.4% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	f89efcf8f971f2e0 (10 x NodeLoader, 9 x FixStealer, 6 x Amadey)
Reporter	01Xyris
Tags:	exe QuasarRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

3'094

Origin country :

CA

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

aporia.exe

Verdict:

Malicious activity

Analysis date:

2025-10-26 22:18:46 UTC

Tags:

pastebin auto-reg crypto-regex api-base64 wmi-base64

Link:

https://app.any.run/tasks/f4689f3b-326a-426d-9eb5-78515ae307a1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fe9e4e3bdc93eb0564b828

Tags:

obfuscate xtreme shell

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

Running batch commands

Creating a file

Creating a window

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Blocking a possibility to launch for the Windows Task Manager (taskmgr)

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm anti-vm crypto expand fingerprint lolbin microsoft_visual_cc

Link:

https://www.filescan.io/uploads/68fe9f21c85c5c569736ac21/reports/88211830-4a25-4d16-8024-9e90b705248f/overview

Hybrid Analysis Backdoor.Win64.Quasar

Verdict:

Suspicious

Labled as:

Backdoor.Win64.Quasar

Link:

https://www.hybrid-analysis.com/sample/fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-26T19:33:00Z UTC

Last seen:

2025-10-27T19:00:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.Win32.Generic HEUR:Trojan.MSIL.Shelpak.gen HEUR:Trojan.MSIL.Chepl.a Backdoor.MSIL.Agent.sb Trojan-PSW.Win64.Stealer.sb Trojan-PSW.MSIL.Agent.sb Trojan.Win32.Vimditator.sb Trojan.MSIL.Quasar.fjf Trojan.MSIL.Quasar.fio Trojan.MSIL.Inject.sb Backdoor.SharPi.HTTP.C&C Trojan.MSIL.Quasar.a Trojan.MSIL.Agent.sb HEUR:Trojan-Banker.MSIL.ClipBanker.gen

Link:

https://opentip.kaspersky.com/fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552/results?tab=lookup

Nucleon Malprob Susipicious

Score:

48%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552

CERT.PL MWDB

Gathering data

Neiki Family.QUASAR

Verdict:

Malicious

Threat:

Family.QUASAR

Link:

https://tip.neiki.dev/file/fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-10-25 16:20:07 UTC

File Type:

PE+ (Exe)

Extracted files:

13

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ircjh7vczluqqdsza7fhykueexrfv3ftjcp5ne6c2mc3vhl6vja._file

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar execution persistence spyware trojan

Link:

https://tria.ge/reports/251026-1947tawmep/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Adds Run key to start application

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Badlisted process makes network request

Quasar RAT

Quasar family

Quasar payload

Threat.Zone Unknown

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f744e3a4-3c88-4428-93e5-185a488ac4e0

VMRay QuasarRAT

Malware family:

QuasarRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fa22249ff516/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.