MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca1c5656cf42853895526560f01436dd63e68eb5470de9f419c87a7b6824b2c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	ca1c5656cf42853895526560f01436dd63e68eb5470de9f419c87a7b6824b2c1
SHA3-384 hash:	a9277fa58e9c6356139168ba0213a2b9a6e63141defc342180785b8654ae78e5500b3caa4f1d840ce0b721e55ee14d57
SHA1 hash:	320b1264ed83f0bc424cff93f4125293ba9e6a73
MD5 hash:	9161a2c1e699fcd79e267c58261383f5
humanhash:	undress-sodium-utah-violet
File name:	9161a2c1e699fcd79e267c58261383f5.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	65'536 bytes
First seen:	2022-04-26 04:42:07 UTC
Last seen:	2022-04-26 05:32:17 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	1536:19jg/iSAuh97aojBBqcvPaDPNdFZqGFPioJfgWmeF:1LSAuHJRvaPBZfqojmeF
TLSH	T1B3538DD2A203DE1AD0D7EBBBCC1452035B72E72E413B83FB6A86105FD8897C78545AD9
TrID	49.9% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win32 Executable (generic) (4505/5/1) 9.6% (.EXE) OS/2 Executable (generic) (2029/13) 9.5% (.EXE) Generic Win/DOS Executable (2002/3) 9.4% (.EXE) DOS Executable Generic (2000/1)
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/266627/

Detection(s):

SecuriteInfo.com.Trojan.KillProc2.17645.30381.20883.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated overlay packed

Link:

https://www.filescan.io/uploads/6267785bc8e9011bd4e1c1fa/reports/dbbbfe2b-dd9f-45ba-83b9-43d2a0825a3a/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/45029b03-e0ca-4d1a-9672-8547b508dbac

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/982909

Signature

.NET source code contains potential unpacker

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca1c5656cf42853895526560f01436dd63e68eb5470de9f419c87a7b6824b2c1/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-04-26 04:43:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

12 of 26 (46.15%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ziofmvwpikctrfksmvqpafbw3vr6ndvvi4g6t5azzb5hw2bewlaq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220426-fb9pesfbcl/

Unpacked files

SH256 hash:

ca1c5656cf42853895526560f01436dd63e68eb5470de9f419c87a7b6824b2c1

MD5 hash:

9161a2c1e699fcd79e267c58261383f5

SHA1 hash:

320b1264ed83f0bc424cff93f4125293ba9e6a73

Link:

https://www.unpac.me/results/79e0f001-da8d-4684-a138-e7f2d0e773d6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ca1c5656cf42853895526560f01436dd63e68eb5470de9f419c87a7b6824b2c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.