MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c406529949bb3bbebfb00bf76a0a279723640e983a6afc600f608942b44a61e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c406529949bb3bbebfb00bf76a0a279723640e983a6afc600f608942b44a61e3
SHA3-384 hash: d184e876d728b509a70696d0430ad942288be34c4340a6d96120c91714a08c8514c96cdfbe7b1935b4c86e35ba924626
SHA1 hash: 8334b3f9a39993decc745e5cadbd773b5066203c
MD5 hash: 3a56d85cacc0170f1e075c5e39289112
humanhash: low-cat-butter-table
File name:TOP URGENT RFQ 2021 Anson Yang.rar
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'377'818 bytes
First seen:2021-01-04 07:37:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:AIwil5iUirmKGoHrNtT7fAgB8WVAQ4YBiSXrM7+UD0Vp8Fp1NIamyiW/Fb0:7V5Qi6LHiI4mMsqD1NIEiGF0
TLSH 4B5533977C6BAF0A244A61F9A90B38E8D151A4171181EAD647CF7834A1433E6CEF0D3F
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: Anson Yang <weldman.huang@msa.hinet.net>
Reply-To: weldman.huang@msa.hinet.net
Subject: Re::TOP URGENT RFQ 2021
Attachment: TOP URGENT RFQ 2021 Anson Yang.rar (contains "TOP URGENT RFQ 2021 Anson Yang.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c406529949bb3bbebfb00bf76a0a279723640e983a6afc600f608942b44a61e3/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-04 03:58:00 UTC
AV detection:
2 of 47 (4.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqdffgkjxm535p5qbp3wucrhs4rwiduyhjvpyyapmceufnckmhrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c406529949bb3bbebfb00bf76a0a279723640e983a6afc600f608942b44a61e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar c406529949bb3bbebfb00bf76a0a279723640e983a6afc600f608942b44a61e3

(this sample)

QuasarRAT

Executable exe 7e7076c3ea0c14873923567195208738da17678b03c1bbc5d10a80c3570b26b3

  
Dropping
MD5 414c39c1a4d1628764f85eb505a491fe
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e7076c3ea0c14873923567195208738da17678b03c1bbc5d10a80c3570b26b3

Comments