MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f34becc10240e3c2c2b7589cba67a957594d5795017d6c5af870e7ece716fcda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuasarRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f34becc10240e3c2c2b7589cba67a957594d5795017d6c5af870e7ece716fcda
SHA3-384 hash: debb55907695c2fbda0b718a15f6da201292270c1863bf1ff34c200d153a7586e40255b466c4827fe041fca745615c00
SHA1 hash: 873454e3ade6ec8dc70df59619de2a340460a797
MD5 hash: be53ca41d03fc3577297f98ca10ecc9f
humanhash: winner-montana-nineteen-glucose
File name:SWIFT COPY.zip
Download: download sample
Signature QuasarRAT
Create hunting rule
File size:556'535 bytes
First seen:2021-02-24 06:28:34 UTC
Last seen:2021-02-26 07:53:45 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:ezPFviG3EdmM9O0UmKuUCVoaTGGePUubk+561:ez9aoEv91Uujyjz9w
TLSH D0C4236C4FAA09DC6EB900FDC3F1C94157C1BA81A3D90570318971986B6DBFA5892FE3
Reporter cocaman
Tags:QuasarRAT SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""LITBRIGHT CANDLE (SHIJIAZHUANG) CO.,LTD"<shipping6@litbright.com>" (likely spoofed)
Received: "from 665an.xyz (unknown [129.211.53.86]) "
Date: "Wed, 17 Feb 2021 03:05:13 +0200"
Subject: "Re: Swift Copy"
Attachment: "SWIFT COPY.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn112.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21744.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f34becc10240e3c2c2b7589cba67a957594d5795017d6c5af870e7ece716fcda/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 01:25:22 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nf6zqicidr4fqvxlcoluz5jk5mu2v4vaf6wywxyodt6zzyw7tna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

QuasarRAT

zip f34becc10240e3c2c2b7589cba67a957594d5795017d6c5af870e7ece716fcda

(this sample)

QuasarRAT

Executable exe 2c02449b93edf06e6fcf3ef1e7391f75feaa4d4cc403cba834d5adca9d7aef3f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c02449b93edf06e6fcf3ef1e7391f75feaa4d4cc403cba834d5adca9d7aef3f

Comments