MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54a7356867bf9fa064f348ba3211493c9164f024da3e10b3738203b7e288c6a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54a7356867bf9fa064f348ba3211493c9164f024da3e10b3738203b7e288c6a1
SHA3-384 hash: d73ba5a45f1078a574f0de9cfccb6d48fa323e18cf44d3b71ceebfed8d54900b12d9915ffd3f2f1aa5ecb5e9ceeb0367
SHA1 hash: c85981a9dd27467ad7e4bf91af5be62eca08dd18
MD5 hash: f2bb77378edafc48c7890ea53678e0bb
humanhash: floor-diet-iowa-fix
File name:Receipt790009465.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:578'850 bytes
First seen:2020-10-10 07:13:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:OZAp7LS4OSqWREVXQlWBZfQ6tA4ZX0fwIrF+ZPb3:OYL5OSqZHR5mf/iPb3
TLSH 43C43381508020B7C964DCA8EAE693F05465BFF6D7D91B4C4077239FFB42E81EAA8563
Reporter abuse_ch
Tags:BitRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.nxtinvoice.site
Sending IP: 104.168.159.5
From: Joan Robert <postmaster@invoicez.xyz>
Subject: Credit Card Payment Receipt
Attachment: Receipt790009465.rar (contains "Receipt#790009465.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54a7356867bf9fa064f348ba3211493c9164f024da3e10b3738203b7e288c6a1/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 05:53:13 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ksttk2dhx6p2azhtjc5deekjhsiwj4be3i7bbm3tqib3pyuiy2qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/54a7356867bf9fa064f348ba3211493c9164f024da3e10b3738203b7e288c6a1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 54a7356867bf9fa064f348ba3211493c9164f024da3e10b3738203b7e288c6a1

(this sample)

BitRAT

Executable exe 52f5e7a9a44771795325822713ff8c37f4efa674bbbb375523c3982ab79a52dd

  
URLhaus
https://urlhaus.abuse.ch/host/blindlemmingchiffon.net/
  
Dropping
MD5 252703f06ed0145ae5e27cc3c0cb9845
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 52f5e7a9a44771795325822713ff8c37f4efa674bbbb375523c3982ab79a52dd

Comments