MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevCodeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8
SHA3-384 hash: 0a847672a4871d585a52286fc61840c9a057df33d33492a81015e4061643016e3433e83147828923d2facec914c02ba0
SHA1 hash: 8953680419d700de778f1c5905a5f0d7fdbb548d
MD5 hash: b776f299003ca5b86a199c2ef01f39f0
humanhash: thirteen-paris-hamper-tennessee
File name:Statement_zd4vWiNB908TG99.uue
Download: download sample
Signature RevCodeRAT
Create hunting rule
File size:990'823 bytes
First seen:2020-08-05 08:41:37 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:ukC92UTCIIcWjPfLjZRgytVh82nzOr+3ccn+DKnxQ+Ew+V:092UT3IcWjXfZRgI3zOonSYt+V
TLSH 332533371E4BC49DD11C0EC90D82A1A7E5BCCABFD26F53882807563EB09D3B507699A7
Reporter abuse_ch
Tags:RevCodeRAT uue


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: [50.3.177.69]
Sending IP: 50.3.177.69
From: accounts@inter-corpproltd.com
Subject: RE: STATEMENT OF ACCOUNT
Attachment: Statement_zd4vWiNB908TG99.uue (contains "zd4vWiNB908TG99.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:43:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nztbgsviwksdc7qof77s3btfyjdweogiun6wmnm7h2kiat27q34a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevCodeRAT

uue 6e66134aa8b2a4317e0e2fff2d8665c2476238c8a37d66359f3e94804f5f86f8

(this sample)

RevCodeRAT

Executable exe 3c8d5a42b3b1e9ec4c489d8ec98ba60d6d107e62b2d1a2cc43570840374ff05f

  
Dropping
MD5 f3370ea593b2afe30af97925d3a63295
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c8d5a42b3b1e9ec4c489d8ec98ba60d6d107e62b2d1a2cc43570840374ff05f

Comments