MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1eb139873d87131e9df36149967e191694667f28a2ec60e0dd70cf71f1f020c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1eb139873d87131e9df36149967e191694667f28a2ec60e0dd70cf71f1f020c2
SHA3-384 hash: 5d8e16971ff5d062b2f64f17b59e38d72b4f195459384b81d530953d32bac6b891bcaa0db2fb158761da5247c4050692
SHA1 hash: 946192a40618ed18aa6bfb42dce607bb2c3ae62a
MD5 hash: a08d660bc25cfc4c7fcd65e3c898db39
humanhash: oranges-october-johnny-virginia
File name:SPECIFICATION.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:233'177 bytes
First seen:2021-02-11 06:18:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:VwWQzsbnv9P6ih6OAsYU3stN+PKoX64jtnO:0wnV16ONYUSYPKoX64c
TLSH C13422DE331292E6DA17C9FE9B1DE44138BD77D243AD558A322DE4E84CF87069D08A1C
Reporter cocaman
Tags:QuasarRAT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""LITBRIGHT CANDLE (SHIJIAZHUANG) CO.,LTD"<shipping@litbright.com>" (likely spoofed)
Received: "from mail.sixqq.top (unknown [192.144.215.94]) "
Date: "Tue, 9 Feb 2021 17:04:42 -0800"
Subject: "Re: Kindly Confirm Please"
Attachment: "SPECIFICATION.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs820.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21365.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1eb139873d87131e9df36149967e191694667f28a2ec60e0dd70cf71f1f020c2/
Threat name:
ByteCode-MSIL.Trojan.Burkina
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 03:12:25 UTC
File Type:
Binary (Archive)
Extracted files:
45
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d2yttbz5q4jr5hptmfezm7qzc2kgm7ziulwgbyg5odhxd4pqedba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Starter
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/1eb139873d87131e9df36149967e191694667f28a2ec60e0dd70cf71f1f020c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip 1eb139873d87131e9df36149967e191694667f28a2ec60e0dd70cf71f1f020c2

(this sample)

QuasarRAT

Executable exe c012726a5c8ccf282423a294da346a3259f21d3a642a3344e248a6ea08c48c82

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c012726a5c8ccf282423a294da346a3259f21d3a642a3344e248a6ea08c48c82

Comments