MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f90ec8045ea9fda03816573266dccb1facdba1f3eac2b3d30ea7d5b5eb1c2a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f90ec8045ea9fda03816573266dccb1facdba1f3eac2b3d30ea7d5b5eb1c2a2
SHA3-384 hash: 53a4f2ff1442a026ceb017e6738b0d6bab113c488b7c4fcb803af694e7a367defbc4942b6c761cd9144ba741fb5129f8
SHA1 hash: f9fb59683dee29a85ae8a069416ff32f2e00213e
MD5 hash: c3182a6b089efda5d75676b9715ce488
humanhash: lima-ohio-black-kitten
File name:Voice_message0002110.img
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:100'352 bytes
First seen:2022-04-07 07:11:35 UTC
Last seen:2022-04-07 07:18:22 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:ath6WDu3Y6Uk9jg+rr6GbOsKpeQiQKWZ:ODud7r6GiX8QiQ/Z
TLSH T175A36B40EAC45A98CA6DC732E466838607776E46487A92D83FDD7D6B4FB33C0191D336
Reporter cocaman
Tags:img


Avatar
cocaman
Malicious email (T1566.001)
From: ""bankofkenosha.com - voicemail service"<cpa@smartbrief.com>" (likely spoofed)
Received: "from mail.johnburch.co.uk (host-92-27-6-45.static.as13285.net [92.27.6.45]) "
Date: "6 Apr 2022 20:07:57 +0200"
Subject: "You received a new voice message from a contact in your address book"
Attachment: "Voice_message0002110.img"

Intelligence

File Origin
# of uploads :
5
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.48820989.30541.16715.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/624e8ec5cccdcb9947227893/reports/30ff03e4-3034-4341-a7b5-0839e8c6e919/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f90ec8045ea9fda03816573266dccb1facdba1f3eac2b3d30ea7d5b5eb1c2a2/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-04-06 17:10:33 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
10 of 42 (23.81%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6iozacf5kp5ua4bmvzsm3omwh5m3oq7h2wcwpjq5j6vwxvrykra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6f90ec8045ea9fda03816573266dccb1facdba1f3eac2b3d30ea7d5b5eb1c2a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

img 6f90ec8045ea9fda03816573266dccb1facdba1f3eac2b3d30ea7d5b5eb1c2a2

(this sample)

AsyncRAT

Executable exe 0332caaf051fed36cd7c7cd8c8ee52b196238673afa8f432873fbdf43336a31b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0332caaf051fed36cd7c7cd8c8ee52b196238673afa8f432873fbdf43336a31b

Comments