MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4e683e787dafe7c6bb47d515b2e13bbc649651aff82ceca9e0d9572f87a231. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd4e683e787dafe7c6bb47d515b2e13bbc649651aff82ceca9e0d9572f87a231
SHA3-384 hash: d32f8ffe8d53d838aeceb156f7aaeb878438f18b05be71229d230472893fdc6951e9866b216ac013bd8b38729197186b
SHA1 hash: 199030e41a48991d5b3c7db1ac1dd1c56f4657a8
MD5 hash: 46b1fa9aa8097d23afc613288613e5f6
humanhash: neptune-montana-mexico-yankee
File name:Payment-Swift059_PDF.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:1'022'029 bytes
First seen:2020-10-26 13:03:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:d/N2BSbu3dv39qspzkekJBdqWdr7rg65yo2n76l:d/Ncz3d4F/JBdqWdr7rB+nG
TLSH F92533C8D34413A11A66142D2FFB5E260BC1D03D1D3D9AB1E3938C9BB1C5CD798EE9A2
Reporter abuse_ch
Tags:QuasarRAT RAT zip


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: tonyhai
Sending IP: 103.225.25.6
From: Finance Team <krajcik@materian.ml>
Subject: RE: HCCI OUTSTANDING PAYMENT $59,459 USD
Attachment: Payment-Swift059_PDF.zip (contains "Payment-Swift059_PDF.exe")

QuasarRAT C2:
23.105.131.221:9000

Intelligence

File Origin
# of uploads :
1
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34931972.27592.6943.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd4e683e787dafe7c6bb47d515b2e13bbc649651aff82ceca9e0d9572f87a231/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 01:55:05 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvhgqptypwx6prv3i7krlmxbho6gjfsrv74cz3fj4dmvol4huiyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip cd4e683e787dafe7c6bb47d515b2e13bbc649651aff82ceca9e0d9572f87a231

(this sample)

QuasarRAT

Executable exe d33b633b962e2851492365a557b624d4682620516513cde765b5e0428c69d917

  
Dropping
MD5 8a76a1a51563aef2532d9cbb90116bfc
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d33b633b962e2851492365a557b624d4682620516513cde765b5e0428c69d917

Comments