MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b762254e0b89ec46a29a917f217e7b2c5e5b0fc8b6f6452082f5c6b55de5a4bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b762254e0b89ec46a29a917f217e7b2c5e5b0fc8b6f6452082f5c6b55de5a4bb
SHA3-384 hash: d5f1a624ec3fdf057089309ce9600d80e80bee69b19d2d3e8ee967f12aa2027988306b3a188fcb782a89ee195c0e9f44
SHA1 hash: 612d99149353ba1cdcae139f2ede5e038908f90f
MD5 hash: 508805191951ad999f3cf6ecc26d6392
humanhash: music-thirteen-uniform-oklahoma
File name:PICTURE SAMPLES SLIDE.Pdf.jpg.img
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-21 07:37:40 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:BwBnyskKKuvlxABbBTBpGflvx/FIwJGunV3cXf:gnyskKKuv3ABbBTy
TLSH D845EFE87FE808D7C4EFF5714C827C35B531B5F61A044A6B704D9697ABC324268A712E
Reporter abuse_ch
Tags:BitRAT img RAT


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: mail2.om18.serverdomain.org
Sending IP: 89.107.188.4
From: WURTH<contact@wuerth.com>
Reply-To: commercial.rlavel@gmail.com
Subject: New Order enquiry
Attachment: PICTURE SAMPLES SLIDE.Pdf.jpg.img (contains "PICTURE SLIDE.scr")

BitRAT C2:
jegebit.duckdns.org:43360 (193.239.147.22)

Intelligence

File Origin
# of uploads :
1
# of downloads :
140
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisADDD33FA7DFF.17508.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b762254e0b89ec46a29a917f217e7b2c5e5b0fc8b6f6452082f5c6b55de5a4bb/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-12-21 07:38:07 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5rcktqlrhweniu2sf7sc7t3frpfwd6iw33ekiec6xdlkxpfus5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b762254e0b89ec46a29a917f217e7b2c5e5b0fc8b6f6452082f5c6b55de5a4bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img b762254e0b89ec46a29a917f217e7b2c5e5b0fc8b6f6452082f5c6b55de5a4bb

(this sample)

BitRAT

Executable exe 841306e5cf2e504499e12c9eae0dbe7f693518555f58eb5e78adf259dbd116c6

  
Dropping
MD5 addd33fa7dff40c390a94c9385b68474
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 841306e5cf2e504499e12c9eae0dbe7f693518555f58eb5e78adf259dbd116c6

Comments