s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2 high

📛 Threat Title

QuasarRAT: v5fueei.exe

Category: QuasarRAT First seen: Last updated: Source: Abuse.ch

Description

File type: exe. Size: 2718720 bytes. Tags: DefendNot, exe, Quasarrat. Reporter: BastianHein_. First seen: 2026-05-13 19:49:06.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain v5fueei.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/v5fueei.exe

IOC database

Type
domain
Value
v5fueei.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/v5fueei.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2 VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2
1 feed

IOC database

Type
hash_sha256
Value
f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
QuasarRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/f5f0e52163104f81b6897b23284e625d9ddcab36751c1552b64a73004f824cf2

hash_sha1 7358de0962f406fa775475bf42c3695fe5800f9b VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/7358de0962f406fa775475bf42c3695fe5800f9b
2 feeds

IOC database

Type
hash_sha1
Value
7358de0962f406fa775475bf42c3695fe5800f9b
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/7358de0962f406fa775475bf42c3695fe5800f9b

hash_md5 a3b170e1a9e66a6a3bc0ddb4c145cba5 VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/a3b170e1a9e66a6a3bc0ddb4c145cba5
2 feeds

IOC database

Type
hash_md5
Value
a3b170e1a9e66a6a3bc0ddb4c145cba5
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/a3b170e1a9e66a6a3bc0ddb4c145cba5

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: exe. Size: 2718720 bytes. Tags: DefendNot, exe, Quasarrat. Reporter: BastianHein_. First seen: 2026-05-13 19:49:06.

Remediations (10)

  • Malware analysis QuasarRat.exe Malicious activity - any.run
    web:any.run

    Online sandbox report for QuasarRat .exe, tagged as evasion, trojan, rat, quasar, verdict: Malicious activity

  • Advent of Configuration Extraction - Part 2: QuasarRAT Config - Sekoia ...
    web:blog.sekoia.io

    In the second part of our "Advent of Configuration Extraction" series, we unwrap QuasarRAT , a popular .NET remote access trojan (RAT), and show how to extract its encrypted configuration out of the binary. The article begins by detailing the environment: Jupyter Notebook, pythonnet, dnSpy and friends—so every step is reproducible. Next, it presents the construction of a Python-based ...

  • QuasarRAT — a powershell helping of fod
    web:colliernathan.wixsite.com

    For my first malware analysis on my new blog, we are looking at QuasarRAT . This piece of malware is a perfect example of what modern Windows malware looks like using a combination of current obfuscation tactics, PowerShell, and schtasks. According to MalwareBazaar, QuasarRAT has been around since 2020. Therefore, it is perfect piece of malware to get things started.

  • Exposing the Core Functionalities of QuasarRAT: Encrypted ... - GBHackers
    web:gbhackers.com

    In the second installment of the "Advent of Configuration Extraction" series, security researchers have unwrapped QuasarRAT , a widely-deployed .NET remote access trojan (RAT).

  • GitHub - malwares/QuasarRAT: Remote Administration Tool for Windows
    web:github.com

    QuasarRAT Free, Open-Source Remote Administration Tool for Windows Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you.

  • QuasarRAT Malware Analysis Report | by psy_maestro | Medium
    web:medium.com

    QuasarRAT Malware Analysis Report Introduction QuasarRAT is an open-source RAT (Remote Access Tool/Trojan). These tools are built for legitimate purposes like accessing remote computers, e.g ...

  • Quasar Remote Access Tool and Its Security Risks - Darktrace
    web:www.darktrace.com

    Discover how the Quasar remote access tool can become a vulnerability in the wrong hands and strategies to mitigate these risks.

  • Backdoor:Win32/QuasarRAT.A threat description - microsoft.com
    web:www.microsoft.com

    Following the mitigation steps below can help prevent hack tool attacks. Keep backups so you can recover data affected by trojans and destructive attacks. Use controlled folder access to prevent unauthorized applications from modifying protected files. Harden internet-facing assets and ensure they have the latest security updates.

  • infected by QuasarRAT.A malware, what to do?? : r/Advice - Reddit
    web:www.reddit.com

    Skipping to today; I've just pulled another scan, and Windows found 8 (!) malware applications! 7 of them were QuasarRAT.a, the other one was a Trojan. I found the source and how it got onto my pc and removed it. Windows defender did its thing and removed the 8 malwares which were in quarantaine.

  • QuasarRAT Incident Response - Recovery Guide (2026)
    web:www.yazoul.net

    Eradication and Recovery This phase involves complete removal and restoration of affected systems. Complete Removal: Follow the detailed, step-by-step procedures in the dedicated QuasarRAT Removal Guide. This guide provides per-system instructions for: Terminating malicious processes. Removing all associated files from the filesystem.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.