MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a
SHA3-384 hash: ec048cf56ffb5b578b3fd76d7da12c2290ec3bd6e8d1ebd1ef461535c83aa6deb4acd880619e387f7a7a613acaf6b871
SHA1 hash: cd5733b0d0c8ed5520f017e50c9e4b992f260b88
MD5 hash: 1b5253f12a76c5b111750d1e2f22d5b6
humanhash: lemon-wolfram-floor-social
File name:DHL_455462.IMG
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'441'792 bytes
First seen:2021-09-19 16:55:14 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:bmnGyuE9fz9VBCY4Alz2MjbjBQHhazE2mdvnk6LHC7WWnMvwfHVBPggseBnDz5ZE:bmnZbz9e0z12HLBngseBDz5ZE
TLSH T108658E12B3844CF5F931193A8EDA77A13929BDF024A95D4F6DF43E142A647A2393C48F
Reporter cocaman
Tags:BitRAT DHL img


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL Express" <express@dhhl.com>" (likely spoofed)
Received: "from practical-hypatia.185-176-221-140.plesk.page (unknown [185.176.221.140]) "
Date: "Sat, 18 Sep 2021 00:51:45 +0800"
Subject: "Pending Delivery"
Attachment: "DHL_455462.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

SecuriteInfo.com.UDS.Backdoor.Win32.Remcos.gen.30130.2328.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a/
Threat name:
Win32.Infostealer.BestaFera
Create hunting rule
Status:
Malicious
First seen:
2021-09-17 17:32:02 UTC
AV detection:
7 of 45 (15.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e6srovlfrx72aco4lytl4lz57bs2k3wu4lz5f4fg64tk2kr5pn5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img 27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a

(this sample)

BitRAT

Executable exe ff28079581ca00e790039ab9d81ab6330df81a2ab58e1836f3dcf60011696823

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff28079581ca00e790039ab9d81ab6330df81a2ab58e1836f3dcf60011696823

Comments