MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a0257587568005f5a81b41f9ab66520d0dd4b987c6c2129fb9025fd51553eae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a0257587568005f5a81b41f9ab66520d0dd4b987c6c2129fb9025fd51553eae
SHA3-384 hash: 28aac053e5c051f8caa1accf17df9bf76eb3b40505fb62b28eee83f34a51d7b121d400816e3b439b45a4986e1179f7fe
SHA1 hash: f6e6eabc7a9f7236a17f03f7398fb82b7a723bcb
MD5 hash: a04e46989a10f139c6a9fab8d843fe9f
humanhash: lake-bluebird-single-coffee
File name:Xeron_Scan2312202007112.gz
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:113'514 bytes
First seen:2020-12-23 18:59:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:d11OFiujVa1ucabHIyTu8KJa4glRFdSumF:NOYueuca9BKJaJbFhw
TLSH F8B312D3DEB2E1A98F4400C1A39B69B6F138868546C71E0CAC6472BDBB9BF41446D67C
Reporter abuse_ch
Tags:AsyncRAT FedEx gz RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: s1008.xrea.com
Sending IP: 150.95.9.228
From: FedEx <no-reply@fedex.com>
Subject: Delayed Parcel Delivery
Attachment: Xeron_Scan2312202007112.gz (contains "Xeron_Scan2312202007112.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
661
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.23134.3944.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a0257587568005f5a81b41f9ab66520d0dd4b987c6c2129fb9025fd51553eae/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-23 19:00:06 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hibfowdvnaaf6wubwqpzvntfedin2s4yprwcckp3sas72ukvh2xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a0257587568005f5a81b41f9ab66520d0dd4b987c6c2129fb9025fd51553eae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip 3a0257587568005f5a81b41f9ab66520d0dd4b987c6c2129fb9025fd51553eae

(this sample)

AsyncRAT

Executable exe 43d7b3a707ca34f0a9f1f5b8c5f07ceb64f225567aa0db7f4cfdcbe7253a93a8

  
Dropping
MD5 7b2955fceb50c1e7bbaa41b9761bbaba
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 43d7b3a707ca34f0a9f1f5b8c5f07ceb64f225567aa0db7f4cfdcbe7253a93a8

Comments