MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 284ee1eb7cce83fd5e676d4a96c65cd8d6732a0b6a34dad21a0dec4badc1d3ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 284ee1eb7cce83fd5e676d4a96c65cd8d6732a0b6a34dad21a0dec4badc1d3ee
SHA3-384 hash: 4fd35ec8abc3d9f677850b5ff67565d744d9efe7a1e5befa30c30c2d6426bb9e3c1b3a128961427b2a275977c33a3ce4
SHA1 hash: 9f12ce4b12586355de887eb9686e522b650007da
MD5 hash: b05fb65dd093e5067b5b6e0da0de6528
humanhash: nuts-skylark-spring-triple
File name:Receipt_389449009.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:443'514 bytes
First seen:2020-10-15 10:46:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:0+ERNK911DjBr7GwQSaKDDNRBmwQxZuccHJDmU4Gq:KN619Br7GSaKD5YxMHVmUE
TLSH C594231056F5718325800D72E9FB07235EB94023A865EEB70B47A27FD23F1AD7892E9D
Reporter abuse_ch
Tags:BitRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.invoicez.xyz
Sending IP: 104.168.165.165
From: "Jose Peter" <postmaster@blerti.xyz>
Subject: Payment Receipt 02201R and shipping details
Attachment: Receipt_389449009.rar (contains "Receipt_389449009.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/284ee1eb7cce83fd5e676d4a96c65cd8d6732a0b6a34dad21a0dec4badc1d3ee/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 03:34:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fbhod234z2b72xthnvfjnrs43dlhgkqlni2nvuq2bxwexlob2pxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/284ee1eb7cce83fd5e676d4a96c65cd8d6732a0b6a34dad21a0dec4badc1d3ee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 284ee1eb7cce83fd5e676d4a96c65cd8d6732a0b6a34dad21a0dec4badc1d3ee

(this sample)

BitRAT

Executable exe c115174d5a3406d4fcb05170c50293df6f3e1bd14619db5b2be777e16c0f8c5d

  
Dropping
MD5 7f090e91a988556d2e9c7db8b714d011
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c115174d5a3406d4fcb05170c50293df6f3e1bd14619db5b2be777e16c0f8c5d

Comments