MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd0da5a488e7d4bf274e63bc23f649a200e234fdfa75a2fa2b77c5db334b8f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fd0da5a488e7d4bf274e63bc23f649a200e234fdfa75a2fa2b77c5db334b8f1c
SHA3-384 hash:	fd4972fe525130abe8203036a9157da0d033c06af84d86f585b55d35033ac6581711e903a79b563492ef153eba2cb60e
SHA1 hash:	d9f438f1c874fa574b6392dcfe352e021a2e4ac3
MD5 hash:	6582cea8e1df393bc40a163d0deee3c9
humanhash:	william-mexico-yankee-oven
File name:	ORDER PO.vbs
Download:	download sample
Signature	QuasarRAT Alert Create hunting rule
File size:	59'449'712 bytes
First seen:	2025-04-09 06:43:03 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:rlOyjjeZvsBef7e3vtEMUETN9BgSXsm6wzX/:PQb7SOE9Dcm6wL
Threatray	36 similar samples on MalwareBazaar
TLSH	T146D72BD233FD6660BAF39F969072221A473E3D832C7E838D625458699E73281D5B0737
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	abuse_ch
Tags:	QuasarRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

109

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f61e1971beff15dccd9c74

Tags:

autorun quasar

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/67f6170c40adfb5162bd15d3/reports/6c914ca7-33b8-498f-9f73-fa048829e944/overview

Hybrid Analysis NetWorm

Verdict:

Suspicious

Labled as:

NetWorm

Link:

https://www.hybrid-analysis.com/sample/fd0da5a488e7d4bf274e63bc23f649a200e234fdfa75a2fa2b77c5db334b8f1c

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1660415

Signature

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Paste sharing url in reverse order

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

73%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fd0da5a488e7d4bf274e63bc23f649a200e234fdfa75a2fa2b77c5db334b8f1c

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-WScript.Trojan.QuasarRAT

Threat name:

Script-WScript.Trojan.QuasarRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-09 01:33:58 UTC

File Type:

Text (VBS)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ug2ljei47kl6j2omo6ch5sjuiaoenh57j22f6rlo7c5wm2lr4oa._file

Threatray quasarrat

Verdict:

malicious

Label(s):

quasarrat

Alert

Create hunting rule

Similar samples:

17dd3793d4bbf9e90e53df26678489a7b82e65d1eeecf396eb088b444a164f85

QuasarRAT

19b9972f970ca207cf8494582bdf8c68b8a1f9cbbc9a8df0151d05c26cb9b3a1

QuasarRAT

2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80

QuasarRAT

2be211f45f8595e6e9b55ba227173aed35eb1ce53fb119beceb49f236232814d

QuasarRAT

3a07acb9e24dace059cea1a5c9c90f457e3c0d3e823805ae2fd0241d75917fc2

QuasarRAT

3c313c19ce509197f848990ef3837d2fdf55ed5d9eb2ddf2f1cd9f35e41bd664

QuasarRAT

acae2eb792f7d641ffa6b0fb92e885db935307ba0dba00afe113b78a9c1d267f

QuasarRAT

cdc2106e6e47fe9e06e5c1b655b8428706cf3db33e31b854ddf3e1269d9c7978

QuasarRAT

cdff410d32d5b177320f80eb8bc6be51de994bd11cc17e7013ae400e1947ca6f

QuasarRAT

error

QuasarRAT

+ 26 additional samples on MalwareBazaar

Hatching Triage quasar

Result

Malware family:

quasar

Alert

Create hunting rule

Score:

  10/10

Tags:

family:quasar botnet:office04 defense_evasion discovery execution persistence spyware trojan

Link:

https://tria.ge/reports/250409-hg3jeasky7/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Adds Run key to start application

Hide Artifacts: Hidden Window

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Drops startup file

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Quasar RAT

Quasar family

Quasar payload

Malware Config

C2 Extraction:

michiko.linkpc.net:4447

Dropper Extraction:

https://pastebin.com/raw/pzXGkayU

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.