MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79b1ae0de1b105ce476d00064eaf9dd93f5595966280c56a3188287826bd69ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79b1ae0de1b105ce476d00064eaf9dd93f5595966280c56a3188287826bd69ef
SHA3-384 hash: b5746515741bd5abf5563fd9cc303f9596803cb65ecbf1e247a3ab8b3197fb1ef225671701f8424b34c76cab3ef29f5d
SHA1 hash: 5a61053ded63734f2cc55de85abd86752a75085a
MD5 hash: b1678657c77a04803741ec7841bb61a3
humanhash: virginia-michigan-ceiling-white
File name:DHL Details 1.img
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'162'688 bytes
First seen:2020-12-22 11:46:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Kr8hZo5FunaOrhBOarAcWY93VzQuEgDnqLiD5wQiM+5CY3Qfi++uhOi85JqgR:Qvwaw7ScWYHzQuj7WLjz593QpSiyJ3
TLSH 62A533416EB58905CF1CA23DD876266793AEF60C27006ED77DCD54D223A28989F78F0E
Reporter abuse_ch
Tags:BitRAT DHL img RAT


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: zen-euler.13-84-144-116.plesk.page
Sending IP: 52.171.139.201
From: DHL Customer Service <customer@dhl.com>
Subject: DHL - Pending delivery
Attachment: DHL Details 1.img (contains "DHL Details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.5544.31758.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79b1ae0de1b105ce476d00064eaf9dd93f5595966280c56a3188287826bd69ef/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 11:47:05 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgy24dpbwec44r3naade5l453e7vlfmwmkamk2rrrauhqjv5nhxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79b1ae0de1b105ce476d00064eaf9dd93f5595966280c56a3188287826bd69ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img 79b1ae0de1b105ce476d00064eaf9dd93f5595966280c56a3188287826bd69ef

(this sample)

BitRAT

Executable exe 1b95de55808c88599a46d6a21a0063a874a6e2ca7f0644989ce60eee025a6485

  
Dropping
MD5 2013c8e78aa7d963e4ff2bd326114424
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b95de55808c88599a46d6a21a0063a874a6e2ca7f0644989ce60eee025a6485

Comments