MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cee12b3e781c641e5edf45572098ac68056afe9de0939398f22de9699774753d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: cee12b3e781c641e5edf45572098ac68056afe9de0939398f22de9699774753d
SHA3-384 hash: a4c3e338214684f3fdbf30eaee371f8b83b24f7db4e50902446f41779930d20eed24a80fde6944d8d0233eb7c86e5f43
SHA1 hash: eb0a9ff866f4ad58ca3d57d84cd75ec0a575bb10
MD5 hash: 01fcd35272676e389bbcdcd3c4a1634e
humanhash: ceiling-violet-lactose-white
File name:Doc66202009475352576539000.zip
Download: download sample
Signature AsyncRAT
File size:621'887 bytes
First seen:2020-06-18 17:21:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:u5PMXni5kY+WWNTbEqlVgU/iyy1JJom9SyPiZ8SQJMdGL4IMI2B:YPYxrHheJJn9Sy69MCoH/2B
TLSH 87D4336944FEE6E8BFC2F5700D2524AB91D32AE7AC538F0EE3C879984B66F514408771
Reporter @abuse_ch
Tags:AsyncRAT zip


Twitter
@abuse_ch
Malspam distributing AsyncRAT:

HELO: rt.plasticmold-parts.com
Sending IP: 208.123.119.131
From: Purchase <purchase@arabico.ae>
Subject: URGENT QUOTATION - arabico company dubai
Attachment: Doc66202009475352576539000.zip (contains "Doc#66202009475352576539000.exe")

Intelligence


File Origin
# of uploads :
1
# of downloads :
37
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Status:
Malicious
First seen:
2020-06-18 17:40:31 UTC
AV detection:
8 of 48 (16.67%)
Threat level
  5/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

zip cee12b3e781c641e5edf45572098ac68056afe9de0939398f22de9699774753d

(this sample)

  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment

Comments