MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abae2833788571f363235cc7d861435aa83ef227d801668b4a84b81353b09ffc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abae2833788571f363235cc7d861435aa83ef227d801668b4a84b81353b09ffc
SHA3-384 hash: fa4d05fada09f9d65acff9dcf6ecb96394f447798b45cab1a00b18003a0dbff9ca100d5aafad466d4038f3edc61520c6
SHA1 hash: e8674dca73cde2b34fff4dd1a5e80ffbd38d7094
MD5 hash: cd68e07cc30688b6bf99fe698af6c3ea
humanhash: idaho-lithium-lemon-uncle
File name:ORDER-0987634_PO.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'136'425 bytes
First seen:2021-03-08 15:07:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:Y9Y88HhsZYi5JVwIUCSrFBa+iMy/zmA1MPB/yn:j8shdi56rM5Ctyn
TLSH B8A53366D97FB43837F96BC8E3CE008886C0A5DF9CD1C53462DA004A0EE65D6DBF8A51
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server2.intuya.com
Sending IP: 81.169.192.7
From: ALIMENTOS MURCIA <info@alimurcia.com>
Subject: PO
Attachment: ORDER-0987634_PO.rar (contains "ORDER-0987634_PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-08 02:00:22 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=voxcqm3yqvy7gyzdltd5qykdlkud54rh3aawnc2kqs4bgu5qt76a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/abae2833788571f363235cc7d861435aa83ef227d801668b4a84b81353b09ffc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar abae2833788571f363235cc7d861435aa83ef227d801668b4a84b81353b09ffc

(this sample)

BitRAT

Executable exe 203ac3379fb9ca3dd9c50d81234c753493ac422538c30d9a9ea07cb5f5042a7b

  
Dropping
MD5 5833d21aca67f98a988b17ab6c8f1db6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 203ac3379fb9ca3dd9c50d81234c753493ac422538c30d9a9ea07cb5f5042a7b

Comments