MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01fe0c9e5c014e7e8f7691a63be151d57588473c66e87c3c031daded400463f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01fe0c9e5c014e7e8f7691a63be151d57588473c66e87c3c031daded400463f5
SHA3-384 hash: 48460860b3526d5bd8819eed3f25cdf34cac663fb29cecef7201c1ec00dd43a4e1340c9c5c8d55c6ad2f7746a27d3e85
SHA1 hash: 8577dffc76950768e291d164f47a77a87a69550c
MD5 hash: 02b221aec6dc36f2d2a9e699c5838b4c
humanhash: ack-mockingbird-fix-mirror
File name:Shipping_Documents_INV_PL_and_BL,pdf.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:404'429 bytes
First seen:2021-01-15 07:11:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:bQcwA1ycqWRBtRG3CLZ7gjEPaTiBMrnEwehxTF3DXXAYAbTDDuUvOct7dO:5dBTGStkYPeiEE/fXAYAbLDZg
TLSH F28423E94EA40F27382B583EFC8401045B5784AC8EE6661776970727BAA7BD35313C9F
Reporter abuse_ch
Tags:AsyncRAT DHL RAT zip


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: mail9.welislinghung.com
Sending IP: 161.35.237.190
From: DHL Express <support@dhl.com>
Subject: DHL Shipment Arrival : 3720991024
Attachment: Shipping_Documents_INV_PL_and_BL,pdf.zip (contains "Shipping_Documents_INV_PL_and_BL,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts46.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25375.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01fe0c9e5c014e7e8f7691a63be151d57588473c66e87c3c031daded400463f5/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:12:08 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ah7azhs4afhh5d3wsgtdxykr2v2yqrz4m3uhypaddww62qaemp2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/01fe0c9e5c014e7e8f7691a63be151d57588473c66e87c3c031daded400463f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip 01fe0c9e5c014e7e8f7691a63be151d57588473c66e87c3c031daded400463f5

(this sample)

AsyncRAT

Executable exe 7acc028b1fdf2fd2d09fec663aca4d5c440ac4f206cc6c45857cee5c8761c335

  
Dropping
MD5 da325b68d3b24d11a3f7b82365ad2c0f
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7acc028b1fdf2fd2d09fec663aca4d5c440ac4f206cc6c45857cee5c8761c335

Comments