MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b3a39cbf39fc5adb8190ab84e1bf061e861c7f393d48d7a1b1ab830d80ada9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b3a39cbf39fc5adb8190ab84e1bf061e861c7f393d48d7a1b1ab830d80ada9c
SHA3-384 hash: 5ea8489dfafd747c78f3822a0e9ae844b278f1b85b230cb2799c45575eb1627c007e8ccc436ab05f355fe385743254f6
SHA1 hash: b26271dc7821ec2768bf718c7358ab33899e78da
MD5 hash: 8e787eae68fef205e769cc5352050eef
humanhash: winter-sweet-august-butter
File name:New_Bank_Information.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:498'151 bytes
First seen:2020-07-28 15:45:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yWRtDwzpJhG4CpxTCcT6bYSD9VZgJTYoE3EyVA:FPUdIpxTj9SD9UYT3EUA
TLSH 5FB423F1F8461BAC713492023D303B158191CCE94DB45BB679A635AABEB9421AFC74CF
Reporter abuse_ch
Tags:Hostwinds QuasarRAT RAT zip


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: hwsrv-751170.hostwindsdns.com
Sending IP: 142.11.236.230
From: Accounts Stally <accounts@timsistem-rs.com>
Reply-To: accounts@timsistem-rs.com
Subject: FW: Re: Please Confirm Change Of Bank Details
Attachment: New_Bank_Information.zip (contains "New_Bank_Information.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
333
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Artemis8870566BD821.16380.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b3a39cbf39fc5adb8190ab84e1bf061e861c7f393d48d7a1b1ab830d80ada9c/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 15:46:12 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hm5dts7tt7c23oazbk4e4g7qmhugdr7tspki26q3dk4dbwak3koa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3b3a39cbf39fc5adb8190ab84e1bf061e861c7f393d48d7a1b1ab830d80ada9c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip 3b3a39cbf39fc5adb8190ab84e1bf061e861c7f393d48d7a1b1ab830d80ada9c

(this sample)

QuasarRAT

Executable exe 707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058

  
Dropping
MD5 fb6d84ef009530fe590ff062bb674c6f
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058

Comments