Malicious
Malicious

Share on LinkedIn
Print
ZIP Archive
MD5:
Size: 0 B
application/zip
Ctrl + scroll to zoom · drag to pan

The file 2f3c0ed245f51ba046dc425e32409890f029a235cf0cc4330c5088bc1465053d_password_infected.zip is a ZIP Archive identified by Malva.RE as QuasarRat (rat). Static analysis extracted 8 embedded or derived files, a malware configuration (QuasarRAT config.) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Malicious
File type
ZIP Archive
Family
QuasarRat
Category
RAT
C2 (defanged)
185[.]233[.]164[.]129

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
ZIP archive

2 malicious · 9 files
ZIP2f3c0ed245f51ba046dc425e32409890f029a235cf0cc4330c5088bc1465053d_password_infected.zipQuasarRat
TXTfilename.txt
EXE2f3c0ed245f51ba046dc425e32409890f029a235cf0cc4330c5088bc1465053d.binQuasarRat
Structure

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key ZHHBiAhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port
Host 185.2huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
185.2huhuhuhuhuhuhu
Port PORTmalicious
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙