MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 210007bd80339f57edb214c0d2429efbfb5a8349746c005f8140eab932c1817f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 210007bd80339f57edb214c0d2429efbfb5a8349746c005f8140eab932c1817f
SHA3-384 hash: 2f1c7b1b8900c61619d241e2b6698df7e719f1119db7a3be26b90f2cc2dc443aec0134dce21400edf9c0c4b7504cca09
SHA1 hash: 378bbf143dd53206e845267b0c3ba6e75f64982d
MD5 hash: fe3596ae8aba7e6a9c5f20f8da202e21
humanhash: timing-low-connecticut-november
File name:PR-2008-0644.zip
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'738'875 bytes
First seen:2020-10-15 10:55:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:PLe+Fn0LMdrawl7FhRvuP0cuuy7rgiOCeV8NSJ:Te+BhfdFDvuP0DoJ
TLSH 9A8533E8A95318102F376619E9DB59E35D2178097C9C9DF13B03AA28AFC33F57A70E44
Reporter abuse_ch
Tags:BitRAT zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.jdctraders.store
Sending IP: 45.95.169.96
From: Klavdija Vezjak <info@jdctraders.store>
Subject: Repeat Order
Attachment: PR-2008-0644.zip (contains "Order SHWSO1018810 Nilorn Trading Company Ltd.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.44071637.29423.15966.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/210007bd80339f57edb214c0d2429efbfb5a8349746c005f8140eab932c1817f/
Threat name:
Win32.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 20:16:37 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eeaappmagopvp3nsctanequ67p5vva2jorwaax4bidvlsmwbqf7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/210007bd80339f57edb214c0d2429efbfb5a8349746c005f8140eab932c1817f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

zip 210007bd80339f57edb214c0d2429efbfb5a8349746c005f8140eab932c1817f

(this sample)

BitRAT

Executable exe 3a53fc0060de3daa43eda52ecb4348ede9d1d95ba89e81906c19da1afd9376b5

  
Dropping
MD5 8fb21ec8fa5a28c03a3c9d37064eba62
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a53fc0060de3daa43eda52ecb4348ede9d1d95ba89e81906c19da1afd9376b5

Comments