MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 200df27c79208a2811eb83a32fe7fb35a122334b4859a8f4bf74b63a4011921e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	200df27c79208a2811eb83a32fe7fb35a122334b4859a8f4bf74b63a4011921e
SHA3-384 hash:	1b7681085cae9eef6cd93e293b9a5a62f3fbc525cc969d6b6c2d66f261c8b873fb7dd92fbbbc23b394b8439fe9a942ef
SHA1 hash:	4586da26e0c2b6dbf5f3340d0f3405de812dff8a
MD5 hash:	07fc400c6d27c8e722361db4f2a1e635
humanhash:	hamper-tennis-queen-nevada
File name:	V-M_2022.img
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	106'496 bytes
First seen:	2022-07-07 06:32:12 UTC
Last seen:	2022-07-07 07:39:29 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	768:6Qxh9EVZgCnQeTF4Fs5p6+2KW0sR06iM:DMFQeTF4AxWBe6V
TLSH	T118A35B817644831DDDAB853664D382610673AEF1CE3A47CA30DC773E6FB7962192239B
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	AsyncRAT img

cocaman

Malicious email (T1566.001)
From: ""karschcapital.com - voicemail" <voicemail@vonagebusiness.com>" (likely spoofed)
Received: "from smtp.ptncs.co.id (smtp.ptncs.co.id [103.31.132.185]) "
Date: "Wed, 6 Jul 2022 17:27:37 +0000"
Subject: "Voicemail Message (WIRELESS CALLER > info) From:(289-110-6456)"
Attachment: "V-M_2022.img"

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.DownLoader45.3567.10765.10776.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/62c67e5f98766731ae84750f/reports/a2cb62db-389f-4369-b696-c94f79411e25/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/200df27c79208a2811eb83a32fe7fb35a122334b4859a8f4bf74b63a4011921e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-07-06 14:52:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eag7e7dzecfcqeplqors7z73gwqsem2ljbm2r5f7os3duqarsipa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/200df27c79208a2811eb83a32fe7fb35a122334b4859a8f4bf74b63a4011921e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research