MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9395f278cfbd4d9498f4671e1a78a3733fb164501ffaa435b4d52a514901f269. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9395f278cfbd4d9498f4671e1a78a3733fb164501ffaa435b4d52a514901f269
SHA3-384 hash: b9c9e65bd177223f4b0e9e16355af37ba8d9a1b9680bd0e4225f791a04d609cb367d808923645bbcddbf5edc0df31bfd
SHA1 hash: ce163d68a145e04e283c384e52866789474e6db5
MD5 hash: 22c1c6fdfc34347068e443afdd31b28d
humanhash: coffee-oregon-solar-sixteen
File name:CF09550WJ901.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:505'614 bytes
First seen:2020-08-28 05:44:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gk8eqNsW7LBFYBYWnrm49T7UWaq4f7PIc:gkgnz7+T7UWH4fTV
TLSH 6EB423505E6906BB0533A2F239DBB64F977FCA5425188B0C20F60C1B4D5A3E6FB319E6
Reporter abuse_ch
Tags:AsyncRAT FedEx OVPN RAT zip


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: [193.56.28.237]
Sending IP: 193.56.28.237
From: [FedEx TW] <noreply@fedex.com>
Reply-To: no-reply.fedcx@workmail.com
Subject: 聯邦快遞出口貨物放行報單通知-提單號碼HAWB: 811734476057
Attachment: CF09550WJ901.zip (contains "CF09550WJ901.pdf.exe")

AsyncRAT C2:
185.157.162.81:9980

Hosted on OVPN:

% Information related to '185.157.162.0 - 185.157.162.255'

% Abuse contact for '185.157.162.0 - 185.157.162.255' is 'abuse@ovpn.com'

inetnum: 185.157.162.0 - 185.157.162.255
geoloc: 52.3757967 4.875317
netname: NL-OVPN
descr: OVPN Amsterdam
country: NL
admin-c: OIA19-RIPE
tech-c: OIA19-RIPE
status: ASSIGNED PA
mnt-by: MNT-OVPN
created: 2016-11-29T11:53:29Z
last-modified: 2020-06-02T06:29:45Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9395f278cfbd4d9498f4671e1a78a3733fb164501ffaa435b4d52a514901f269/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 03:25:54 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sok7e6gpxvgzjghum4pbu6fdom73czcqd75kinnu2uvfcsib6juq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9395f278cfbd4d9498f4671e1a78a3733fb164501ffaa435b4d52a514901f269

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip 9395f278cfbd4d9498f4671e1a78a3733fb164501ffaa435b4d52a514901f269

(this sample)

AsyncRAT

Executable exe 3309682d4e7fe2d802cbe22c698b31d93e4d35a5ee611aedabc1f6e1f6a96e46

  
Dropping
MD5 d131c464871190f0110952675e1cd52e
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3309682d4e7fe2d802cbe22c698b31d93e4d35a5ee611aedabc1f6e1f6a96e46

Comments