MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ac6e63d2f01e3a54f73034749bcd551d5846b5fdaaf48c9d9579a62ced3f9a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ac6e63d2f01e3a54f73034749bcd551d5846b5fdaaf48c9d9579a62ced3f9a9
SHA3-384 hash: e89e5af9f9b3494da9633132e0affbbc24a50fb3a04883e0d2fbdc4572360dc04134cb4738b4c261e181f3d9fe03efe8
SHA1 hash: 29b96984bc612f22c4c560f77c209f6c1919ca96
MD5 hash: 32992c7c5ca2d3b9f171a05cfe378d63
humanhash: dakota-arkansas-monkey-eight
File name:FedEx Shipment 427781339903.img
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-23 06:56:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Tq8j0e3GM1FQv/WoJ2gvxgG39KHhWVYeaU:7Ien1FbPixR5
TLSH 09457D20265CAB4EE03EBB794120521F43F16526D327E68F7DE951DB7EA2F404B72A13
Reporter abuse_ch
Tags:AsyncRAT FedEx img RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: server.desenvolvertalentos.online
Sending IP: 85.187.151.235
From: trackingupdates@fedex.com <trackingupdates@fedex.com>
Subject: FedEx Shipment 427781339903 Notification
Attachment: FedEx Shipment 427781339903.img (contains "FedEx Shipment 427781339903.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ac6e63d2f01e3a54f73034749bcd551d5846b5fdaaf48c9d9579a62ced3f9a9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 06:57:07 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lldompjpahr2kt3tandutpgvkhkyi2273kxursozk6ngftwt7guq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/5ac6e63d2f01e3a54f73034749bcd551d5846b5fdaaf48c9d9579a62ced3f9a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

img 5ac6e63d2f01e3a54f73034749bcd551d5846b5fdaaf48c9d9579a62ced3f9a9

(this sample)

AsyncRAT

Executable exe d798fc1115e9b445231646cc0fdbb5e1aa248b063bdb1e5b2f64739ac3682e9c

  
Dropping
MD5 fda94856fea41b64688fcfa3cdb214e4
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d798fc1115e9b445231646cc0fdbb5e1aa248b063bdb1e5b2f64739ac3682e9c

Comments