🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb73cc1e598f000632533d9f11155b4a9b3dc225b67aec32eb30f5c0439e200c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb73cc1e598f000632533d9f11155b4a9b3dc225b67aec32eb30f5c0439e200c
SHA3-384 hash: 80ea3c81c0f140a479c94e0b76ce540638e2cb2353eff5a7ade8afb351db999db1eab7d514ae00abf2aa7e02b7e0ee35
SHA1 hash: 56ddba0b06d890f93b3cf1c7c55ce0173befceff
MD5 hash: 5ff924d09f0f443d85f6d04ab020b1db
humanhash: robert-summer-georgia-carbon
File name:IMG_Mia_Khlifa_20220603.zip.7z
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:401'026 bytes
First seen:2023-01-14 20:30:53 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
Note:This file is a password protected archive. The password is: infected
ssdeep 12288:QT+Kjms94nPHQGBZeBlyGF+/SYjA+dZq00xnWRt:iBWwAZejga7w
TLSH T1C28423983E0E7584008E19FE2A1F1F2BA29D2753E29C145D614BD6F5EC84B6F371C16E
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Reporter x3ph1
Tags:7z AsyncRAT remcos

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
US US
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:'
File size:716'553 bytes
SHA256 hash: 57dbc210fa42fd21656be05b9f4e3d9996f71c3c166b161ff7f7c24679402c8b
MD5 hash: 3c8743f6d4dad339316d4a62e821634b
MIME type:application/octet-stream
Signature AsyncRAT
File name:IMG_Mia_Khlifa_20220603.vbs
File size:1'849'454 bytes
SHA256 hash: c62ef09ac5b47ea517047fd3719bb2e93b37b97f4c7477198c4b4d2383c227b6
MD5 hash: 4fb6199509a8edbf44569fdfbdf3bed0
MIME type:text/plain
Signature AsyncRAT
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm shell32.dll
Link:
https://www.filescan.io/uploads/63c31108de614a115a164028/reports/e351f9b3-b30b-45b9-ab9e-b5e71b5c82e2/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb73cc1e598f000632533d9f11155b4a9b3dc225b67aec32eb30f5c0439e200c/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=znz4yhszr4aammsthwprcfk3jknt3qrfwz5oymxlgd24aq46eaga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb73cc1e598f000632533d9f11155b4a9b3dc225b67aec32eb30f5c0439e200c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments