MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 186d8b9254dec67460972b868da3b385e1494b05c2a340567f043d79842bd2c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 186d8b9254dec67460972b868da3b385e1494b05c2a340567f043d79842bd2c6
SHA3-384 hash: 5cd0de1f99749cad7f9019088c745d7ee606e12e4ed1b6199d293dfdb06bfe299c850ac8a492f5a96595e9e73be5d31d
SHA1 hash: 38e35878d0101aea1c57088c3a420cfe24a5438c
MD5 hash: 4f8f2e20f00dda5f6f390897d9bec1dc
humanhash: glucose-fanta-monkey-mars
File name:Transfer Confirmation Ref MT103 _0012822.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:145'923 bytes
First seen:2020-10-26 15:34:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:0wAcdKr1KDRPDGD5Y5U+vCg/Fz7q6XakCFcabgOeeODiZ:5Aq1DGD5Y5UtWFP4kEZe1DiZ
TLSH 70E31263F28EE764D780DEA9C1DB1EAEFAD72564AA293B2DE109C430B303045736F415
Reporter abuse_ch
Tags:AsyncRAT nVpn RAT zip


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: linuxserver.mirackle.com
Sending IP: 67.55.118.192
From: Account-Dept Maria <kavonuis.leonidas@gmail.com>
Subject: Re:Confirmation transfer
Attachment: Transfer Confirmation Ref MT103 _0012822.zip (contains "Transfer ConfirmationRef MT103 _0012822.exe")

AsyncRAT C2:
freshg.ddns.net:2256 (185.140.53.141)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE
country: BE
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-10-02T20:59:33Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/186d8b9254dec67460972b868da3b385e1494b05c2a340567f043d79842bd2c6/
Threat name:
ByteCode-MSIL.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 11:18:50 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dbwyxesu33dhiyexfodi3i5tqxqussyfykruavt7aq6xtbbl2lda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip 186d8b9254dec67460972b868da3b385e1494b05c2a340567f043d79842bd2c6

(this sample)

AsyncRAT

Executable exe 334ab59399997e54878083e726a2dbc5d41f844025742b4ea35921a93bf24d68

  
Dropping
MD5 63a37df730cee021c6660cce6be272e0
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 334ab59399997e54878083e726a2dbc5d41f844025742b4ea35921a93bf24d68

Comments