MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b7e7f1d22bb5e31ab8ff025c514f42ed85fdae9a0011acb51e3244950e28a06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b7e7f1d22bb5e31ab8ff025c514f42ed85fdae9a0011acb51e3244950e28a06
SHA3-384 hash: 53a5e3e9dc56d3e7d481c4580418346b3f0a6906a38865fcbff0f36bded94e24d8cfe9c64b45112449a108c017fbd73e
SHA1 hash: 95f78ab27e095a1f32f71c9e9b3ba4cf347cde76
MD5 hash: 76fa52c398656ea66db2deea51794b82
humanhash: monkey-wyoming-shade-triple
File name:ORDER-PO29394934.lzh
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:602'165 bytes
First seen:2020-10-11 16:40:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CtHC/b3EEhLi8UUTnBxbmskwe2vSbp4rD4AqxsrhdIRVc:CRC/DNhgUTBl0h244rD4krvSc
TLSH CDD423C91E2F8330AC417F68B590FB93AEEA577875026A62144F620DBF6DC5B41B1DC8
Reporter abuse_ch
Tags:lzh QuasarRAT RAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: sales <arktex@cyber.net.pk>
Subject: New ORDER - Quotation Request
Attachment: ORDER-PO29394934.lzh (contains "ORDER-PO29394934.exe")

QuasarRAT C2:
greathop.fastestmaking.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b7e7f1d22bb5e31ab8ff025c514f42ed85fdae9a0011acb51e3244950e28a06/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-11 13:04:10 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pn7h6hjcxnpddk4p6as4kfhuf3mf7wxjuaarvs2r4msesuhcrida._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7b7e7f1d22bb5e31ab8ff025c514f42ed85fdae9a0011acb51e3244950e28a06

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar 7b7e7f1d22bb5e31ab8ff025c514f42ed85fdae9a0011acb51e3244950e28a06

(this sample)

QuasarRAT

Executable exe 32298d53ff378e1f1597076d02226c84755b84a84fd40f6261cd1e4cbd723384

  
Dropping
MD5 9f269ba2988704d0b895016b337f2875
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32298d53ff378e1f1597076d02226c84755b84a84fd40f6261cd1e4cbd723384

Comments