MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c18e32f62749b4a7301ce9013e3487ad4a98449d8ee80d813c11e21f9f3648ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XpertRAT

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	c18e32f62749b4a7301ce9013e3487ad4a98449d8ee80d813c11e21f9f3648ec
SHA3-384 hash:	c2d30b7875aff6a83af7b5ad4b9635de5958c5aa3e9065fe424e47a24e20a38b409bd4609cfbca97dfd204e9c261dde2
SHA1 hash:	07cb6bfd8ff0d24248536221b5b52f7ca21dab04
MD5 hash:	36846cbd6f90ab1c9d6558b9636d5ece
humanhash:	winner-two-triple-texas
File name:	03-07-2020_Hitachi Compressor_spare parts for Adsoption AC 220, spare parts for RENNER RS 45-15TI6yy
Download:	download sample
Signature	XpertRAT Create hunting rule
File size:	526'880 bytes
First seen:	2020-08-13 08:25:13 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:rJuzEQxedbLM8nsOnwZxITn9/EAuX0AIN3:rJgxedVXwYT5eX1IV
TLSH	95B423B67CB37996ED108CD46A9E1EE954F3532DD4858C5BB421B386D87E8F22A013F0
Reporter	abuse_ch
Tags:	geo nVpn RAT THA XpertRAT

abuse_ch

Malspam distributing XpertRAT:

HELO: server.kibriswebtasarimi.com
Sending IP: 176.9.21.149
From: n-naphutsakorn@hctl.hitachi-asia.com
Subject: Confirm ใบสั่งซื้อ PO # AK070144 - Hitachi compressor
Attachment: 03-07-2020_Hitachi Compressor_spare parts for Adsoption AC 220, spare parts for RENNER RS 45-15TI6yy (contains "03-07-2020_Hitachi Compressor_spare parts for Adsoption AC 220, spare parts for RENNER RS 45-15TI6yyuqxmiPlmQKpdf.exe")

XpertRAT C2:
194.5.98.159:3456

Hosted on nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU6
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-07-30T03:41:26Z
source: RIPE