MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5d95b66258e87dcd6955c6f323459e7726131096e6b2db0613f4ab2b4bff486. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5d95b66258e87dcd6955c6f323459e7726131096e6b2db0613f4ab2b4bff486
SHA3-384 hash: 15bcc0dc88f26aa780aefd5c243570ba96788a47b3a0dd76d88bdbd9cac5c8884aa52965dabc44309239a34a81eedc85
SHA1 hash: 3d298efc668178ab8042f6ca444e638d0e42d2c6
MD5 hash: 97705a3e9a0580a874bc241315f3636d
humanhash: pluto-six-princess-three
File name:XEROX_BIAT22.12.20.gz
Download: download sample
Signature BitRAT
Create hunting rule
File size:8'169 bytes
First seen:2020-12-22 11:48:33 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 192:k9Aq8xlnIvGPqdA6vayW8LHuiUYLb92nEfciNMI:u8SJu6w3oUnEfnz
TLSH 64F1AF1B37E6E453F7BA00CA22BD28C5125D211DD34AA161CD301F82AFAD42F169CA6E
Reporter abuse_ch
Tags:BitRAT gz RAT


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: bsmtp.bon.at
Sending IP: 213.33.87.14
From: Biat<info@biat.com.tn>
Subject: PAIEMENT
Attachment: XEROX_BIAT22.12.20.gz (contains "XEROX_BIAT22.12.20.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5d95b66258e87dcd6955c6f323459e7726131096e6b2db0613f4ab2b4bff486/
Threat name:
Binary.Malware.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 11:49:03 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxmvwzrfr2d5zvuvlrxtencz45zgcmijnzvs3mdbh5flfnf76sda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a5d95b66258e87dcd6955c6f323459e7726131096e6b2db0613f4ab2b4bff486

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

gz a5d95b66258e87dcd6955c6f323459e7726131096e6b2db0613f4ab2b4bff486

(this sample)

BitRAT

Executable exe 51a88ec38988b46095fdae57516afa6043dbbc67ec0ababc172d00111e9b7424

  
Dropping
MD5 373419738d7f6cab9cbfce2fa48b6b09
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51a88ec38988b46095fdae57516afa6043dbbc67ec0ababc172d00111e9b7424

Comments