MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33cba6eaf8974ef37943054c04b5d50be71357c286c381c58f4d67b647fbff0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33cba6eaf8974ef37943054c04b5d50be71357c286c381c58f4d67b647fbff0d
SHA3-384 hash: b119ec2bce0dec6bc319075ee1a0a09b0bfb6f8cf011332055df67cdfb1def6adb2c43dc0474256ea71dc0824304fad7
SHA1 hash: e50f6ae277d4e6b2d735ee9734f45f6b78c23fd7
MD5 hash: bbf6e1670ac1967b90213d6dcbc2f1b2
humanhash: iowa-burger-hydrogen-high
File name:QT21006189.rar
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:177'217 bytes
First seen:2021-01-26 06:38:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:JySBpk3wNmVkbTcZFL9gtHRZkNNOSQ93dVPe3mFsCN9NXyoCW2tVvCckbzeD9o2H:xLkUiCwbE/kbOSQ93dVUCbNPMtBCJbzu
TLSH C10423FB244CE7966201FA404D63AE8049598F7C4774A6DD82BAA13CAB038E64C3DB56
Reporter cocaman
Tags:QuasarRAT rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Mina Girgis Metry <Mina.Metry@eim-eg.com>" (likely spoofed)
Received: "from mail4.ferotrade.ch (unknown [143.110.232.8]) "
Date: "26 Jan 2021 06:07:57 +0100"
Subject: "QUOTATION REQUIRED"
Attachment: "QT21006189.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33cba6eaf8974ef37943054c04b5d50be71357c286c381c58f4d67b647fbff0d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gpf2n2xys5hpg6kdavgajnovbptrgv6cq3bydrmpjvt3mr7374gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/33cba6eaf8974ef37943054c04b5d50be71357c286c381c58f4d67b647fbff0d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar 33cba6eaf8974ef37943054c04b5d50be71357c286c381c58f4d67b647fbff0d

(this sample)

QuasarRAT

Executable exe ae4aeb52c724cd8c68efe1835558b174b388f7219a467ddb016089ebab4ce695

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae4aeb52c724cd8c68efe1835558b174b388f7219a467ddb016089ebab4ce695

Comments