MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720
SHA3-384 hash: dc5a6913e8df56a25613b74ebd16a8434edbc8596b904c58e5c8eedb4e20766cd618df452633b72ba3639ac87936f894
SHA1 hash: 05e68a503e6e8b34c77fa0780c6fd06c310a1317
MD5 hash: 0a7626252200f305e4140c6d76e860f5
humanhash: fillet-potato-oklahoma-lithium
File name:ORDER343346PO3455.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'308'033 bytes
First seen:2021-04-07 11:22:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:xeWzYF5v1RZ+oxeeC/mnP50B+1O2QhAepgcrrfXL2TL:xeeYF5v1WhnmhLvepgYfXL2TL
TLSH A6B533718CF4195A212833FB29BCE8EBD35C1BB536A48CE8CEDA6CCED91851749D14D2
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: qq.com
Sending IP: 183.3.255.89
From: 袁晓琳 <yuangxiaolin@zhongwangde.com>
Subject: PO#1817911/1817920
Attachment: ORDER343346PO3455.rar (contains "ORDER343346PO3455.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.9469.4091.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720/
Threat name:
ByteCode-MSIL.Spyware.Solmyr
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 11:23:09 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fmhjh4oxhjllqpich6xy6cebdp2y5tzowrniiuzzjgeqdjqsc4qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 2b0e93f1d73a56b83d023faf8f08811bf58ecf2eb45a845339498901a6121720

(this sample)

BitRAT

Executable exe d431d6c234dfb75c3fad9cfe53c800e68eec1df826aeee43cc02d802a234e0c2

  
Dropping
MD5 9ee396f30db2375df1ab7e935acbbcac
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d431d6c234dfb75c3fad9cfe53c800e68eec1df826aeee43cc02d802a234e0c2

Comments