MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed10806f71a746cc08363acb6742e74216134438ae94cbef7901f363cfe2764b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed10806f71a746cc08363acb6742e74216134438ae94cbef7901f363cfe2764b
SHA3-384 hash: ec0c28dd4b8a72589a749e88e05219e8071f072068ca5ead0317f8191e489fcef8c65a2accf6c159d60a1428da15b219
SHA1 hash: 1156a164bc5cf377f804560e8d1c7df98afb4f10
MD5 hash: fdba8ec489271a38f09b56f5761bb0b1
humanhash: foxtrot-freddie-island-wisconsin
File name:ORDER-PO344443LIST.lzh
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:302'981 bytes
First seen:2020-10-12 19:16:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:1MKw0Zp8cpHtTl3xX8yhZnSYkQlZNvtLCODWUm2b0:1MkzVVtTDfSY9Z3LdWUfb0
TLSH A35423FB67059CCA82A49FCF8BE76E0E17313282083D5085BE9E151B687092FD6BC535
Reporter abuse_ch
Tags:lzh QuasarRAT RAT


Avatar
abuse_ch
Malspam distributing QuasarRAT:

HELO: mail.15min.lt
Sending IP: 185.11.24.87
From: sales <habtom2013sale@gmail.com>
Subject: New ORDER - Quotation Request
Attachment: ORDER-PO344443LIST.lzh (contains "ORDER-PO344443LIST.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed10806f71a746cc08363acb6742e74216134438ae94cbef7901f363cfe2764b/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 16:41:40 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5uiia33ru5dmycbwhlfwoqxhiilbgrbyv2kmx33zahzwht7cozfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ed10806f71a746cc08363acb6742e74216134438ae94cbef7901f363cfe2764b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

rar ed10806f71a746cc08363acb6742e74216134438ae94cbef7901f363cfe2764b

(this sample)

QuasarRAT

Executable exe 44cfbbb142d8d2eb853ac5453ebc129955bfe879cc4d41f898e5f52838c682ce

  
Dropping
MD5 845082fce173cddd78c16a425c1bd29e
  
Dropping
QuasarRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44cfbbb142d8d2eb853ac5453ebc129955bfe879cc4d41f898e5f52838c682ce

Comments