MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fc527549f8b0745562114645f42a301c4b4ca8fcd2a9f283c908bc8daf3c94c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevCodeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fc527549f8b0745562114645f42a301c4b4ca8fcd2a9f283c908bc8daf3c94c
SHA3-384 hash: beb29314eefd1ab8f759c82dc859c595daf489be3ff41da202532e291d5f025d8b6ae95032a962d2841dd0dc7db56358
SHA1 hash: 1b8509877ce1f2698aa188eb862b18962d9b5eac
MD5 hash: 341ab9d16467536248af8ca424bf6b51
humanhash: three-red-ink-fifteen
File name:IRS RELIEF PDF.rar
Download: download sample
Signature RevCodeRAT
Create hunting rule
File size:578'892 bytes
First seen:2020-12-09 11:03:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:y3+0XcMTVkdG3PIngjg06aHTXXhNGBv08Ar6LxvyhHlgfoY+iRs8A:y3j1Vkzgbrhgv0NrmvyhFgfZRs8A
TLSH C5C42303E425EF4895BEA9419E9F1B006DED0DD352434BBF1A1C97324DDEE281784ABA
Reporter abuse_ch
Tags:IRS rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: englam.com.sg
Sending IP: 103.11.189.57
From: IRS <noreply@taxpayers.com>
Subject: TAX RELIEF UPDATES
Attachment: IRS RELIEF PDF.rar (contains "IRS RELIEF PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fc527549f8b0745562114645f42a301c4b4ca8fcd2a9f283c908bc8daf3c94c/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 11:04:08 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h7csove7rmdukvrbcrsf6qvdahcljsupzuvj6kb4scf4rwxtzfga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3fc527549f8b0745562114645f42a301c4b4ca8fcd2a9f283c908bc8daf3c94c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevCodeRAT

rar 3fc527549f8b0745562114645f42a301c4b4ca8fcd2a9f283c908bc8daf3c94c

(this sample)

RevCodeRAT

Executable exe 25321bc3e274b62ff03c184cd1a058645d41f842ce0b368019912ada6b3f34df

  
Dropping
MD5 344d15b18835eecf7ada98e055d8e87c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 25321bc3e274b62ff03c184cd1a058645d41f842ce0b368019912ada6b3f34df

Comments