MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f30e9abe6ceff0461452d2f4b5cc5d9305cb63270e851e9ed9948bee4508de4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f30e9abe6ceff0461452d2f4b5cc5d9305cb63270e851e9ed9948bee4508de4c
SHA3-384 hash: 5368a08f830514a0d154e10bfadf802420a5f85d60f830e90319b1ef83535eefbfaf6a1bd7082a8b8297346bad0973da
SHA1 hash: 9f8f03b099157f38de9caec3f81cd63223715478
MD5 hash: 708aca2ce8e4aa2a852f84f695002eff
humanhash: vermont-sweet-maine-winter
File name:Payment-terms_pdf.gz
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:589'053 bytes
First seen:2020-05-21 08:08:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yF7YMjaknPhOGhoYJawQ5F0EiAHkL9zHPDzFl0dTFGXy:yF1amhzawSJWhHPDRl0d0C
TLSH F8C4237B0B125A44ECF4D16050D5BDB51002BF4FA3368BDD2FFA203F962B9451A5EAA8
Reporter abuse_ch
Tags:gz QuasarRAT RAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: hansoll.com
Sending IP: 103.145.255.184
From: HANSOLL TEXTILE LTD<sopark@hansoll.com>
Subject: Regarding Change of Payment Due Date Terms
Attachment: Payment-terms_pdf.gz (contains "Payment-terms_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
335
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.12176.11480.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 04:00:06 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6mhjvptm57yemfcs2l2lltc5smc4wyzhb2cr5hwzssf64rii3zga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip f30e9abe6ceff0461452d2f4b5cc5d9305cb63270e851e9ed9948bee4508de4c

(this sample)

QuasarRAT

Executable exe 7ed14885068667e9de2ede24522ab5e7bc2b02ed2f5953d590517921a3d77f4f

  
Dropping
MD5 5a34a9d0de10945fc472f2bfe3565ce6
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ed14885068667e9de2ede24522ab5e7bc2b02ed2f5953d590517921a3d77f4f

Comments