MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd32b11e7ab2cecab2889b275fdd9ff7176f75d0e30f151d0f9a8a7960b4f629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd32b11e7ab2cecab2889b275fdd9ff7176f75d0e30f151d0f9a8a7960b4f629
SHA3-384 hash: 447994305cfc5b03af5ec995badbfd08b2c279af2eda7c76e6b073f625ad928d9934dcca32ee3f10fdde06e9300d43f8
SHA1 hash: 64a45affc875b2ff373ef81e1d5f99bb15621e2a
MD5 hash: c1871cb159b1cd38000e1f42b3a547ff
humanhash: vermont-juliet-echo-july
File name:ReOrder & Drawing Samples.iso
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-14 10:05:05 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:rAevPxhcSWjZkZbIVPgfyWeh0l55dgxRPYxPWL6okWXdRVfxLg:rAeXQSWFcIVPgfPeOlaxRPYxBW
TLSH 56459D11B680C072D1A228306A36EAB24C6E7C305D74968F77DC3A795FB49D1E625F2F
Reporter abuse_ch
Tags:iso RevengeRAT Yahoo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic314-44.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.132.218
From: sunbumnin1@yahoo.com <sunbumnin1@yahoo.com>
Subject: ReOrder & Drawing Samples.pdf
Attachment: ReOrder & Drawing Samples.iso (contains "ReOrder & Drawing Samples.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
341
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd32b11e7ab2cecab2889b275fdd9ff7176f75d0e30f151d0f9a8a7960b4f629/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:07:04 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xuzlcht2wlhmvmuitmtv7xm764lw65oq4mhrkhiptkfhsyfu6yuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd32b11e7ab2cecab2889b275fdd9ff7176f75d0e30f151d0f9a8a7960b4f629

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevengeRAT

iso bd32b11e7ab2cecab2889b275fdd9ff7176f75d0e30f151d0f9a8a7960b4f629

(this sample)

RevengeRAT

Executable exe cac726f6b0bcb60af61033a9a59ae886ee7466f65e20185cd44be43c80386e7d

  
Dropping
MD5 965a50b0cb0e05ba3fb39aa2dfb64980
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cac726f6b0bcb60af61033a9a59ae886ee7466f65e20185cd44be43c80386e7d

Comments