MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e78557cb42a522c8f3c2f780c9407375737e97cd41bc75d3d3451f438e315a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e78557cb42a522c8f3c2f780c9407375737e97cd41bc75d3d3451f438e315a0
SHA3-384 hash: d00e43905af18c4d72415a52e53567ae2d965c94cf4fa1eafd034b7b9afc8a60c754f7a95747934dbcddc7a0818fec22
SHA1 hash: 90a8de557677c0c373cd4a047ce41b90af861e25
MD5 hash: b4e0328d7c0164cc9234745ae675a3af
humanhash: three-four-nuts-seven
File name:ORDER 201006.img
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:415'744 bytes
First seen:2020-11-18 12:18:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:8YgbXApHfiOkxZ4tNqdQmmQdkCW0C4nh4MgKDY6mEvPTq:1AsfiDxitNBBqknZ4n2MrVTq
TLSH 2A94E0066354D64AD66912366C23C6B6126FFEC652369790BFCCAE4F3FBB705102036E
Reporter abuse_ch
Tags:AsyncRAT img RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: s2.htwservers.com
Sending IP: 104.243.42.199
From: Ahmed Zahid <info@rafc.com.kw>
Reply-To: info@cocoona.ae
Subject: PO #2011018
Attachment: ORDER 201006.img (contains "ORDER #201006.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e78557cb42a522c8f3c2f780c9407375737e97cd41bc75d3d3451f438e315a0/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:19:07 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz4fk7fufjjczdz4f54azfahg5ltp2l42qn4oxj5gri7iohdcwqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

img 6e78557cb42a522c8f3c2f780c9407375737e97cd41bc75d3d3451f438e315a0

(this sample)

AsyncRAT

Executable exe 70795c4cfc9af8305dc404936a20f81ef186501dfbfa09e3c5102835c1e7a246

  
Dropping
MD5 a4c90f52f56e498bbfa1db473bcc04fd
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70795c4cfc9af8305dc404936a20f81ef186501dfbfa09e3c5102835c1e7a246

Comments