MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5264a57d2e10b022f53138eb38f63e69c136ddf10765e69a9028d1b27a65881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5264a57d2e10b022f53138eb38f63e69c136ddf10765e69a9028d1b27a65881
SHA3-384 hash: 06ee6ee3076962644a80c8b732a1439b94658b3061be90fc6fc50af4f994b896c30d675bd5998ba0a2b302769e826e4e
SHA1 hash: 12cbaf28092e31f7512c6710b50475ad1e138124
MD5 hash: cfc4d2d074d9f8b1580c84e29389aeb0
humanhash: steak-hamper-juliet-ink
File name:invoice.rar
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:286'941 bytes
First seen:2020-05-04 20:32:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:h5sIDe/i4lR76wCx94MVg68XqlCBMptvI/zGffM1Vmldi:hO4SLC068eCWex1Vma
TLSH 80542368C1B56A7F033BFF64A01D8168A5D68D934E8B3F05B2652C59C60BF335538D78
Reporter abuse_ch
Tags:MailChannels QuasarRAT rar


Avatar
abuse_ch
Malspam distributing :

HELO: bonobo.birch.relay.mailchannels.net
Sending IP: 23.83.209.22
From: salesinfoinfo459@indalexmachineryltd.com
Subject: Re:Re:Product Inquiry..can you re-do this invoice?
Attachment: invoice.rar (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 20:36:02 UTC
File Type:
Binary (Archive)
Extracted files:
62
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uteuv6s4efqel2tcohlhd3d42obg3o7cb3f42njakgrwj5glcaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar d5264a57d2e10b022f53138eb38f63e69c136ddf10765e69a9028d1b27a65881

(this sample)

QuasarRAT

Executable exe 52d60767d2ff5516a17a6a2a429dd47fd2dafa69a778e1da6129c7f1dd3eeae4

  
Dropping
MD5 eaea515875cf1cd7e30d1e673bdf394d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 52d60767d2ff5516a17a6a2a429dd47fd2dafa69a778e1da6129c7f1dd3eeae4

Comments