MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 debf06b67e40b6983a05884c32c82bf821fc83d57019fb214c4874c5b4dfd342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: debf06b67e40b6983a05884c32c82bf821fc83d57019fb214c4874c5b4dfd342
SHA3-384 hash: 4f6b72e285643876d1b66800bdd9757e14649092e0829d1531de251cf0964e402195d30dcade3d5fbe37d875f61d9c5b
SHA1 hash: 7cfc2a8507d519c470943868647890c0eadac516
MD5 hash: be61aebcd7e87ee3f57562a6ee39b1cd
humanhash: september-spring-east-freddie
File name:CT558801294_504670_03732174347.PDF.tbz2
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'512'592 bytes
First seen:2020-10-14 15:40:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:rGCBUxKpDVBUcDpJNsP2/vW0MXB/iQ6iaN7ZXhG6V4VRjnU/WQ66+rxPGQivrY6m:yJYDVBU34WLB/NKXv4CerxPFw0c6br
TLSH 2A6533A59F1C90F92CEE9E7C875256EE8AD1FB1191FE1041BE91C20D48DB650B3288F7
Reporter abuse_ch
Tags:AsyncRAT Citibank RAT tbz2


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: server.doklsa.us
Sending IP: 185.249.197.82
From: trade.sg@citi.com <trade.sg@citi.com>
Subject: Citibank Transaction Notification
Attachment: CT558801294_504670_03732174347.PDF.tbz2 (contains "CT558801294_504670_03732174347.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/debf06b67e40b6983a05884c32c82bf821fc83d57019fb214c4874c5b4dfd342/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 02:07:45 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=327qnnt6ic3jqoqfrbgdfsbl7aq7za6voam7wikmjb2mlng72nba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/debf06b67e40b6983a05884c32c82bf821fc83d57019fb214c4874c5b4dfd342

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

rar debf06b67e40b6983a05884c32c82bf821fc83d57019fb214c4874c5b4dfd342

(this sample)

AsyncRAT

Executable exe 55b779f35f7ba5b7e409de245f0c6c8c2f7f38292f7d33b42e65f1fe4cbe6ee9

  
Dropping
MD5 e23cff81572101abd02dadc9f6269b6e
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55b779f35f7ba5b7e409de245f0c6c8c2f7f38292f7d33b42e65f1fe4cbe6ee9

Comments