YARAify Scan Results
You are viewing the YARAify database entry for the file with the SHA256 hash a379a924dcd9b5df70fd7678d748cbfb81ca83e7e1d7a2381d7927748469caca.
Scan Results
| SHA256 hash: | a379a924dcd9b5df70fd7678d748cbfb81ca83e7e1d7a2381d7927748469caca | |
|---|---|---|
| File size: | 3'299'328 bytes | |
| File download: | Original | |
| MIME type: | application/x-dosexec | |
| MD5 hash: | ea9124607fd71d6ed66f06b74a03285d | |
| SHA1 hash: | a288f5d15e7896913b2ae3eed6641cbeeb8ec3e2 | |
| SHA3-384 hash: | 60608b7a2e4c322376be9695c92b020a84d4f6b6a7028e784537f9be5c359e90e1513c6c0cc03bcd673bb1336bed5a25 | |
| First seen: | 2026-03-29 17:19:26 UTC | |
| Last seen: | 2026-03-29 19:46:16 UTC | |
| Sightings: | 2 | |
| imphash : | f34d5f2d4577ed6d9ceec516c1f5a744 | |
| ssdeep : | 49152:0yhJJHPNCC7J98vBgJh99oG4znXy4xUuxGUTHHB72eh2NT:0yhrHPh7J98vGJh99tEx | |
| TLSH : | n/a | |
| telfhash : | n/a | |
| gimphash : | n/a | |
| dhash icon : | n/a | |
Tasks
There are 2 tasks on YARAify for this particular file. The 10 most recent ones are shown below.
Task Information
| Task ID: | f2ef6621-2ba7-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | a379a924dcd9b5df70fd7678d748cbfb81ca83e7e1d7a2381d7927748469caca.exe | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL |
|---|
| Signature: | Win.Malware.Generic-9883083-0 |
|---|
| Signature: | Win.Malware.Msilheracles-9900242-0 |
|---|
| Signature: | Win.Packed.Downeks-6898097-0 |
|---|
| Signature: | YARA.DITEKSHEN_MALWARE_Win_Quasarstealer.UNOFFICIAL |
|---|
| Signature: | YARA.SIGNATURE_BASE_MAL_Quasarrat_May19_1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | INDICATOR_SUSPICIOUS_GENInfoStealer |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing common artifacts observed in infostealers |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | MAL_QuasarRAT_May19_1 |
|---|---|
| Description: | Detects QuasarRAT malware |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | MAL_QuasarRAT_May19_1 |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects QuasarRAT malware |
| Reference: | https://blog.ensilo.com/uncovering-new-activity-by-apt10 |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | MAL_QuasarRAT_May19_1_RID2E1E |
|---|---|
| Author: | Florian Roth |
| Description: | Detects QuasarRAT malware |
| Reference: | https://blog.ensilo.com/uncovering-new-activity-by-apt10 |
| TLP: | TLP:WHITE |
| Rule name: | MALWARE_Win_QuasarStealer |
|---|---|
| Author: | ditekshen |
| Description: | Detects Quasar infostealer |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (http://www.lukeacha.com) |
| Description: | Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_imphash |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | quasarrat |
|---|---|
| Author: | jeFF0Falltrades |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | quasarrat_kingrat |
|---|---|
| Author: | jeFF0Falltrades |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RC6_Constants |
|---|---|
| Author: | chort (@chort0) |
| Description: | Look for RC6 magic constants in binary |
| Reference: | https://twitter.com/mikko/status/417620511397400576 |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | win_quasar_rat_client |
|---|---|
| Author: | Matthew @ Embee_Research |
| Description: | Detects strings present in Quasar Rat Samples. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter
Task Information
| Task ID: | 7006a97e-2b93-11f1-b47f-42010aa4000b | |
|---|---|---|
| File name: | ea9124607fd71d6ed66f06b74a03285d | |
| Task parameters: | ClamAV scan: | True |
| Unpack: | False | |
| Share file: | True | |
ClamAV Results
The file matched the following open source and commercial ClamAV rules.
| Signature: | ditekSHen.MALWARE.Win.Trojan.QuasarStealer.UNOFFICIAL |
|---|
| Signature: | Win.Malware.Generic-9883083-0 |
|---|
| Signature: | Win.Malware.Msilheracles-9900242-0 |
|---|
| Signature: | Win.Packed.Downeks-6898097-0 |
|---|
| Signature: | YARA.DITEKSHEN_MALWARE_Win_Quasarstealer.UNOFFICIAL |
|---|
| Signature: | YARA.SIGNATURE_BASE_MAL_Quasarrat_May19_1.UNOFFICIAL |
|---|
YARA Results
Static Analysis
The following YARA rules matched on the file (static analysis).
| Rule name: | BLOWFISH_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for Blowfish constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | INDICATOR_SUSPICIOUS_GENInfoStealer |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing common artifacts observed in infostealers |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | MAL_QuasarRAT_May19_1 |
|---|---|
| Description: | Detects QuasarRAT malware |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | MAL_QuasarRAT_May19_1 |
|---|---|
| Author: | Florian Roth (Nextron Systems) |
| Description: | Detects QuasarRAT malware |
| Reference: | https://blog.ensilo.com/uncovering-new-activity-by-apt10 |
| TLP: | TLP:WHITE |
| Repository: | Neo23x0 |
| Rule name: | MAL_QuasarRAT_May19_1_RID2E1E |
|---|---|
| Author: | Florian Roth |
| Description: | Detects QuasarRAT malware |
| Reference: | https://blog.ensilo.com/uncovering-new-activity-by-apt10 |
| TLP: | TLP:WHITE |
| Rule name: | MALWARE_Win_QuasarStealer |
|---|---|
| Author: | ditekshen |
| Description: | Detects Quasar infostealer |
| TLP: | TLP:WHITE |
| Repository: | diˈtekSHən |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (http://www.lukeacha.com) |
| Description: | Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | pe_imphash |
|---|---|
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | quasarrat |
|---|---|
| Author: | jeFF0Falltrades |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | quasarrat_kingrat |
|---|---|
| Author: | jeFF0Falltrades |
| TLP: | TLP:WHITE |
| Repository: | CAPE |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | RC6_Constants |
|---|---|
| Author: | chort (@chort0) |
| Description: | Look for RC6 magic constants in binary |
| Reference: | https://twitter.com/mikko/status/417620511397400576 |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| TLP: | TLP:WHITE |
| Repository: |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| TLP: | TLP:WHITE |
| Repository: | MalwareBazaar |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | win_quasar_rat_client |
|---|---|
| Author: | Matthew @ Embee_Research |
| Description: | Detects strings present in Quasar Rat Samples. |
| TLP: | TLP:WHITE |
| Repository: | YARAify |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
| Rule name: | classified |
|---|---|
| Author: | classified |
| Description: | classified |
| TLP : | TLP:AMBER |
Unpacker
The following YARA rules matched on the unpacked file.
Disabled by submitter
Unpacked Files
The following files could be unpacked from this sample.
Disabled by submitter