🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1
SHA3-384 hash: 534d0d943327f9fad098122b49bec8c4f846c92b106156862ff48dd08a0eacbf814c2070e7280daa79323c3f45c4babc
SHA1 hash: 6bf2be703b8bd4cd244533fe44bf20632fe3a2d7
MD5 hash: 740ae2984b6dcab569df5530f6f52b82
humanhash: hawaii-pasta-butter-orange
File name:Fa-200000345.zip
Download: download sample
Signature XpertRAT
Create hunting rule
File size:653'698 bytes
First seen:2020-08-10 11:39:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MEBN72inFXgE3dtAwxd0Z00ZVO8RxC09VbfO54geKJ0Hvdl7wihcKIlCU3Lh:Zn7VXgE3H102MJ79V6COuHX7wqq
TLSH C5D423CD1AC315C4589282A9D0A51CF3F1D38E0CCC48AB465597EBCB71BA3F5DA42E8E
Reporter abuse_ch
Tags:RAT XpertRAT zip


Avatar
abuse_ch
Malspam distributing XpertRAT:

HELO: bcsconsultores.es
Sending IP: 217.116.8.54
From: Contabilidad <info@fedizseguros.com>
Subject: CONSULTA TRANSFERENCIA FRA. Nº 345 y Fr. Nº 346.
Attachment: Fa-200000345.zip (contains "Fa-200000345.exe")

XpertRAT C2:
103.141.138.121:4567

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.004be7cd-6760703-0
Create hunting rule

Win.Trojan.Generic-6760707-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Adware.Kraddare.1524.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 11:41:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2lmeocsfdrorqp2ogn2bool7zighlyaokh453773xl43f5tv5xaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XpertRAT

zip d2d8470a451c5d183f4e337417397fca0c75e00e51f9ddfffbbaf9b2f675edc1

(this sample)

XpertRAT

Executable exe 13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3

  
Dropping
MD5 7789215ed9d6d730fb242791151786ea
  
Dropping
XpertRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3

Comments