MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a2c0302bd5342d3f51f979baf7b47c692378d435d0805f6e8a75c39341c1540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a2c0302bd5342d3f51f979baf7b47c692378d435d0805f6e8a75c39341c1540
SHA3-384 hash: 678e26fd01fe4f72a36577d073c26fb700388a0dde7716cba52ed5f75aeca77c1e4fee6b54aba79f76a5313e697acd17
SHA1 hash: e0ef2f40cc5e33d54cb77067307d969c6900afa7
MD5 hash: 1156bf229aa018f88b1624ff6b6ba197
humanhash: blue-princess-sodium-grey
File name:ORDER-PO_99393834.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'290'525 bytes
First seen:2021-03-08 15:05:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:iyoMjplCTVLrDNBBvpQrW1+/pk3Qx/HqGotASAEUSxBf0rESjbPNR:iyHC5BhQq2fvqGSAXSxBfbSjblR
TLSH 5BB533C63371DA27F07E0B22194884C91DAB736EF18B91A851AA1B4E31F39FA05FD715
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server2.intuya.com
Sending IP: 81.169.192.7
From: ALIMENTOS MURCIA <info@alimurcia.com>
Subject: PO
Attachment: ORDER-PO_99393834.rar (contains "ORDER-PO_99393834.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 15:06:07 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jiwagav5knbnh5i7s6n2662hy2jdpdkdlueal5xiu5odsna4cvaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a2c0302bd5342d3f51f979baf7b47c692378d435d0805f6e8a75c39341c1540

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 4a2c0302bd5342d3f51f979baf7b47c692378d435d0805f6e8a75c39341c1540

(this sample)

BitRAT

Executable exe d0a2be2c26efa68a6f69a4173b21c251b3c1e55b4d64cdf67394f923c9c23452

  
Dropping
MD5 5732b00ecce619a113cc5714d53400e3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d0a2be2c26efa68a6f69a4173b21c251b3c1e55b4d64cdf67394f923c9c23452

Comments