MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68a8f7eaa80d715f3daddb11e537f8688f3ae80421dc824cad82d41d96dfab3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68a8f7eaa80d715f3daddb11e537f8688f3ae80421dc824cad82d41d96dfab3f
SHA3-384 hash: acb7be973704676dba2b0e8947e9eab23c1dee8d54c28b040736c185cec8b3cc40066f9fd0aebea8b453aa98550684ae
SHA1 hash: 02f766f8cc7226336c06fa2f2a32d18eb48fd868
MD5 hash: 6902b967a527fd7179ab63c6ad9c1b50
humanhash: green-blue-jig-eight
File name:invoice.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:52'101 bytes
First seen:2020-10-16 13:05:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:LWOfFqirbb8I9F2WyfD9BWqsStKPoGTmuC0qV03me:LP9qEcI9FPy7/WVQuC0qS3me
TLSH 9333F10181697ECD411CC1FE93D646937E4607322EA683912E87F3167D81A7C89FAEBD
Reporter abuse_ch
Tags:BitRAT rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.blerti.xyz
Sending IP: 23.238.49.156
From: Donna Hamm <postmaster@blerti.xyz>
Subject: Invoice # 17217
Attachment: invoice.rar (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68a8f7eaa80d715f3daddb11e537f8688f3ae80421dc824cad82d41d96dfab3f/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 07:48:48 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncupp2vibvyv6pnn3mi6kn7ynchtv2aeehoietfnqlkb3fw7vm7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/68a8f7eaa80d715f3daddb11e537f8688f3ae80421dc824cad82d41d96dfab3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar 68a8f7eaa80d715f3daddb11e537f8688f3ae80421dc824cad82d41d96dfab3f

(this sample)

BitRAT

Executable exe c95785635556400cb71d20445d949c9bc50e5b8681ff7a71648bf23ae5441cf1

  
Dropping
MD5 bbad437e472d66b7702a2c7671260b27
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c95785635556400cb71d20445d949c9bc50e5b8681ff7a71648bf23ae5441cf1

Comments