MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3702ece2474ad1bac1e0860417313828ddd02d05619975d85080d0ec8ee2747d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3702ece2474ad1bac1e0860417313828ddd02d05619975d85080d0ec8ee2747d
SHA3-384 hash: 1ea586b9ef8c78586104618d7e47abcb7e5c40a41bb27938a87a6dbd67860cec59896d9d44db41f0115f43ec3aec741e
SHA1 hash: 7870254b3481284c28062fa65d7b5d40d34d84fb
MD5 hash: b2b79d8f6e199088de79e304437ed164
humanhash: high-muppet-kentucky-michigan
File name:Chemicals Genaral presentation.gz
Download: download sample
Signature XpertRAT
Create hunting rule
File size:226'068 bytes
First seen:2020-07-02 07:05:23 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:VgyoU9j8YgCEyP1Jhdm09V7iM1cD/WgWObbuW/:Vgy1ZzgCFv59V2M1SH
TLSH BC24121E8B0FD4258F9A451DE63382DA398BFF9D1CA57C3A4CAF15F02876C49C1495A3
Reporter abuse_ch
Tags:gz nVpn RAT XpertRAT


Avatar
abuse_ch
Malspam distributing XpertRAT:

HELO: server.kibriswebtasarimi.com
Sending IP: 176.9.21.149
From: procurement <procurement@airproducts.com>
Subject: Tender//2020/07
Attachment: Chemicals Genaral presentation.gz (contains "Chemicals Genaral presentation.exe")

XpertRAT C2:
79.134.225.85:3135

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVRA9D7B2F135E0.6125.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3702ece2474ad1bac1e0860417313828ddd02d05619975d85080d0ec8ee2747d/
Threat name:
ByteCode-MSIL.Infostealer.Azorult
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:07:05 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4bozyshjli3vqpaqycbomjyfdo5alifmgmxlwcqqdiozdxcor6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XpertRAT

gz 3702ece2474ad1bac1e0860417313828ddd02d05619975d85080d0ec8ee2747d

(this sample)

XpertRAT

Executable exe 7b5541d2b21aecc162a92f39f7641986f5cecbbb840257bdb88fa028fc0455bf

  
Dropping
MD5 a9d7b2f135e01501aa61e6dc1b20f598
  
Dropping
XpertRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7b5541d2b21aecc162a92f39f7641986f5cecbbb840257bdb88fa028fc0455bf

Comments