MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3b40679d4e1700b2391186f2325b326c3bb134bd5aeeee1447f5f9b70ed5a81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3b40679d4e1700b2391186f2325b326c3bb134bd5aeeee1447f5f9b70ed5a81
SHA3-384 hash: afc2011fabed5d7f4238293421a74bf8da0551edcc8870fbf430a864092127edbbc0f7c0a00519561cc78ae077f0fa05
SHA1 hash: 1a3ed93c8e9d5f55c308da88fb99828e1ee60d68
MD5 hash: 54c7bfd7adbfbe1a5d2cf8e2ba4725a2
humanhash: early-green-glucose-river
File name:Halkbank_Ekstre_20210118_162356_389771.tar
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'029'120 bytes
First seen:2021-01-18 07:49:49 UTC
Last seen:2021-01-18 08:04:00 UTC
File type: tar
MIME type:application/x-tar
ssdeep 24576:U4n9VNKp6dJxT4lavQ9UwMSK4Wq+BggkBuBGbWq:U49VNtdJxT4YvhSK4UBgZBvJ
TLSH CB258D1053CCDB20D7BC96F89810926067E9E546F658E37CF9BEA0C25F62DA449DFB80
Reporter lowmal3
Tags:AsyncRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3b40679d4e1700b2391186f2325b326c3bb134bd5aeeee1447f5f9b70ed5a81/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 07:50:15 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wo2am6ou4fyawi4rdbxsgjnte3b3we2l2wxo5ykep5pzw4hnlkaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3b40679d4e1700b2391186f2325b326c3bb134bd5aeeee1447f5f9b70ed5a81

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

tar b3b40679d4e1700b2391186f2325b326c3bb134bd5aeeee1447f5f9b70ed5a81

(this sample)

AsyncRAT

Executable exe cdcc8531c42e3ede33c0ecbcb82f7a6e5445e959eee3796475258df830a18813

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdcc8531c42e3ede33c0ecbcb82f7a6e5445e959eee3796475258df830a18813
  
Dropping
MD5 84217fc5c07aabf3321ed2c0feed1cba

Comments