MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77312002c68044e86d6ed1d14d5741e307c96cde5541cfa05a0aff440de3bafc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77312002c68044e86d6ed1d14d5741e307c96cde5541cfa05a0aff440de3bafc
SHA3-384 hash: c60cc95e036fc690e494f910ac2a00c977f65947892d8ca77e1cadd03e9c07cc9649ca65a8d7777cce0b0dbb8db5a92c
SHA1 hash: c7ba633ea9654c5a88e254f1054914218db97ac4
MD5 hash: e9bed3d90bd327396975132279714b68
humanhash: missouri-robin-april-fifteen
File name:Barta GeneralBrochureMIvBiUiGxthLYlq0UbCCfwhzA7zt_PDF.exe.gz
Download: download sample
Signature XpertRAT
Create hunting rule
File size:422'003 bytes
First seen:2020-08-19 09:24:47 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:jnXVBfqhRTP4cvXLXQGgi1OtUoEShWOhbAi:jXrSfgegltNmPi
TLSH E9942309C355F43B4A34D97238E22E3E5220B11A9E5E521BBDB3C10D5ABEC51E1DA78F
Reporter abuse_ch
Tags:gz XpertRAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Barta Yapı <info@bartayapi.com.tr>
Subject: Barta Construction Promotion
Attachment: Barta General BrochureMIvBiUiGxthLYlq0UbCCfwhzA7zt_PDF.exe.gz (contains "Barta General BrochureMIvBiUiGxthLYlq0UbCCfwhzA7zt_PDF.exe.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77312002c68044e86d6ed1d14d5741e307c96cde5541cfa05a0aff440de3bafc/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 09:26:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4ysaawgqbcoq3lo2hiu2v2b4md4s3g6kva47ic2bl7uidpdxl6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XpertRAT

gz 77312002c68044e86d6ed1d14d5741e307c96cde5541cfa05a0aff440de3bafc

(this sample)

XpertRAT

Executable exe 6ad1ca30615fb9469d7b0d254d14964f4dabf786f2f9096d77c0e2e5dbf600b9

  
Dropping
MD5 9bee8e02923c4ce0d3bd0d56f6617731
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ad1ca30615fb9469d7b0d254d14964f4dabf786f2f9096d77c0e2e5dbf600b9

Comments