MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fd882c8d390f7b3b671b8254897b71b4e481ab1bad5502376021df10331f6a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fd882c8d390f7b3b671b8254897b71b4e481ab1bad5502376021df10331f6a9
SHA3-384 hash: 935375f8781027ccc3be851c399511721f120d0ab0753446fdf98d496120ee35bab091c2775532b10e013cc212b469b4
SHA1 hash: bf1d50b02de977cb45b33718ce54a79d7d888762
MD5 hash: e1f7b7404d3ddaef08e404750a0a2958
humanhash: mike-cold-pluto-william
File name:Xeron_20218921000211.gz
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:148'831 bytes
First seen:2021-01-05 07:31:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:l+VXtW1B2xV2RnoLRaKdCXHK3i3DxcD0p4Ad2fb4VnhHksuSTZQ8d:l40aL0KdC3KSFcDFfsDFQ8d
TLSH 2FE312A103DB687517D0B26B277A8E8E07DD7E28CA4D7CF3A45004E195ECF277912C96
Reporter abuse_ch
Tags:AsyncRAT gz RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: mogtanx.com
Sending IP: 153.122.44.55
From: Sarana Dinamika <otulla@saranadinamika.co.id>
Subject: New Order 2021
Attachment: Xeron_20218921000211.gz (contains "Xeron_20218921000211.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Agent.FBOP.20601.23127.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fd882c8d390f7b3b671b8254897b71b4e481ab1bad5502376021df10331f6a9/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-05 07:32:04 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7mifsgtsd33hntrxasurf5xdnheqgvrxlkvai3waio7cazr62uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fd882c8d390f7b3b671b8254897b71b4e481ab1bad5502376021df10331f6a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip 1fd882c8d390f7b3b671b8254897b71b4e481ab1bad5502376021df10331f6a9

(this sample)

AsyncRAT

Executable exe e452ae28b674ac4715a811e24d502948e94489ccb1ed14ca49d3ed8ab395f85c

  
Dropping
MD5 d825f6dbc1d42c1e4d7a0806e77567bc
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e452ae28b674ac4715a811e24d502948e94489ccb1ed14ca49d3ed8ab395f85c

Comments