MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a056ff7f44011d37e283386896ec9a88caed230db51a860e7d31de7cff75f56b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a056ff7f44011d37e283386896ec9a88caed230db51a860e7d31de7cff75f56b
SHA3-384 hash: b84676355eeef1e6a4da58839501da922d2126688b051c66cdcbbfb1f7931e941fd2f55e82c3ea7ccfaf094fd605471a
SHA1 hash: 0a6b1c5c922d0056df79be198185075904cf66a2
MD5 hash: f24d17da798e401f09a73fe1763d8417
humanhash: bluebird-happy-cup-wyoming
File name:appointment letter.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'020'037 bytes
First seen:2020-10-13 05:40:56 UTC
Last seen:2020-10-13 06:48:14 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:EB6IClnblDWHt3wG9iRfsaqfBSl4cUvMKdRpsJ6:vXdbpW6G9iRfsaqfA6MKdRq6
TLSH C9253350FF0F76F99F9F78321977521F42264643A66A3823D42B4385BB1BCC86A1D235
Reporter abuse_ch
Tags:QuasarRAT RAT zip


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: diabos.biz
Sending IP: 103.114.106.7
From: diabos@diabos.biz <diabos@diabos.biz>
Subject: Appointment letter from Eletson Corporation for LPG Kithnos / 012
Attachment: appointment letter.zip (contains "NwZDUeq0TcagOm6.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42621.1824.25230.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a056ff7f44011d37e283386896ec9a88caed230db51a860e7d31de7cff75f56b/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 01:29:52 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
11 of 48 (22.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ublp672eaeotpyudhbujn3e2rdfo2iynwunimdt5ghphz73v6vvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a056ff7f44011d37e283386896ec9a88caed230db51a860e7d31de7cff75f56b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip a056ff7f44011d37e283386896ec9a88caed230db51a860e7d31de7cff75f56b

(this sample)

QuasarRAT

Executable exe d58538fee18c00f55def8bcaee383bc186440ddd55cb24ab8840cab62183e2ab

  
Dropping
MD5 d9568b84f342440c935b9cc0eaf9cd4f
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d58538fee18c00f55def8bcaee383bc186440ddd55cb24ab8840cab62183e2ab

Comments