MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93bca2d6cb962f594a4b8b141076e76d1238a3fc51b042e291e3520259674189. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93bca2d6cb962f594a4b8b141076e76d1238a3fc51b042e291e3520259674189
SHA3-384 hash: 0e82a82732946a9df8a769f68e42db74dd162b542ac50feaf25653babce01ab9b61df3114d1bfd502dc2f44f9a046512
SHA1 hash: a16bb00a40a0b61f6701a7b00005758e0055b55c
MD5 hash: 9c5ec11046d133a3c24f4d80e17306a3
humanhash: kentucky-king-don-steak
File name:dhl detail.img
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'228'224 bytes
First seen:2020-12-18 16:54:20 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:KRFquIUobcc/vfniFwdqXz7Q39XzzHPPf:KRFquK/vfnewdS039jbPP
TLSH FBA523ACF641243FC0D096BD86564617A87569244341B09FFBDCACDEB32A1DEB98230F
Reporter abuse_ch
Tags:BitRAT DHL img


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: focused-noyce.20-185-46-27.plesk.page
Sending IP: 52.170.114.12
From: "DHL Customer Service" <customer@dhl.com>
Subject: DHL - Pending delivery
Attachment: dhl detail.img (contains "dhl detail 2.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BScope.Trojan-Dropper.Injector.3350.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93bca2d6cb962f594a4b8b141076e76d1238a3fc51b042e291e3520259674189/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-18 16:55:07 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=so6kfvwlsyxvssslrmkba5xhnujdri74kgyefyur4njaewlhigeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93bca2d6cb962f594a4b8b141076e76d1238a3fc51b042e291e3520259674189

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img 93bca2d6cb962f594a4b8b141076e76d1238a3fc51b042e291e3520259674189

(this sample)

BitRAT

Executable exe 3faafeae03cf24f47b90a17040357b6b130ec8daf8d39a3410be86dbd767a541

  
Dropping
MD5 4ca223786e043ee4b09ef4d05ba5d032
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3faafeae03cf24f47b90a17040357b6b130ec8daf8d39a3410be86dbd767a541

Comments