MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e9d1d19cd4ac0e24e07f458ca82c1535991a1f1b7da777f93399f33a37ea339. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e9d1d19cd4ac0e24e07f458ca82c1535991a1f1b7da777f93399f33a37ea339
SHA3-384 hash: 1eb8292526a606edaeb51f7574aad73f5b63921e41795417bb8106a37014c3df6169b585d1faa039a14464995847fc64
SHA1 hash: 9ac13219df7d6b0db48daee3c060de8c081ee5c4
MD5 hash: be380430287e874f10f75e4ca81f8a11
humanhash: carpet-enemy-yellow-failed
File name:INVOICE-ORDER CONFIRM.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'087'485 bytes
First seen:2021-03-06 06:46:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:BYemKJcHLnv7tCow4gcfkhW/QyV3uAVeeP4nwo:BYJHDv5/1WW/1V3uheewo
TLSH D6A5337BFAC143CBB2432BB7778CA49C853F81AD3BD5825144B8B07844E57F319A8991
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx1.serviunix.com
Sending IP: 181.48.186.3
From: Maria Elena Castrillon Gaviria <mcastrillon@iprocom.co>
Subject: PROFORM INVOICE
Attachment: INVOICE-ORDER CONFIRM.rar (contains "INVOICE-ORDER CONFIRM.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.25518.13805.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e9d1d19cd4ac0e24e07f458ca82c1535991a1f1b7da777f93399f33a37ea339/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 06:47:07 UTC
AV detection:
10 of 43 (23.26%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/1e9d1d19cd4ac0e24e07f458ca82c1535991a1f1b7da777f93399f33a37ea339

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 1e9d1d19cd4ac0e24e07f458ca82c1535991a1f1b7da777f93399f33a37ea339

(this sample)

BitRAT

Executable exe 5586ef434d41ac7bb60ad57a628edf85fcc53ec6617680e3b77730054eb1076d

  
Dropping
MD5 6282b0c5f353fb2e52ef52934fdf4c9a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5586ef434d41ac7bb60ad57a628edf85fcc53ec6617680e3b77730054eb1076d

Comments