MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevCodeRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa
SHA3-384 hash: 8c96969a461a1ec48b0f635b39c7a0b4a3784da4d9d4646dbdcaec2d664e12a0e8ad9d563e9a858423b917746004bd5f
SHA1 hash: 5571cf04008fae84d2f8f9a6e927cb99bba42e0d
MD5 hash: 730903458642e948f4a02142ae0981b2
humanhash: papa-pip-magazine-hotel
File name:IMAGE20210406_490133692.cab
Download: download sample
Signature RevCodeRAT
Create hunting rule
File size:1'391'950 bytes
First seen:2021-04-06 08:18:08 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:kYoHhLYLzin4uDIEAUKeBZQlK9w7DSB7HQbd1gPqc3v580qLLLBIcCXe7lMZRztG:k/YLzi1I6OK9E7d1Hyy9LLLmcbcztfN0
TLSH 57553372C81DEF2C41B927391942879F8930B853E6ED4181A2A2D5372F07FD166CEE9D
Reporter abuse_ch
Tags:cab geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: Agro-composite glass <anong5701@daum.net>
Subject: 생산 요청
Attachment: IMAGE20210406_490133692.cab (contains "IMAGE20210406_490133692.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 03:38:05 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dh65z3e23wo2khwndy3gfzk7rsg57gltvc5lw3wpyhpyuawghl5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevCodeRAT

cab 19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

(this sample)

RevCodeRAT

Executable exe ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

  
Dropping
MD5 432494553bb7b05ce1970f180968aac3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b

Comments