MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d67d53fd4b3cc54d39ce65bb870af5383308ade42f5f9b04c2775140bc0daa5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d67d53fd4b3cc54d39ce65bb870af5383308ade42f5f9b04c2775140bc0daa5a
SHA3-384 hash: 7caf2281b3699d7c6ad3683af8263fad70fc49528178ac98d74f19828d3833a5b0cccfb83634bd355c38b97989e053f2
SHA1 hash: 1c617888d28608b23661b277a1d5ef266b075a41
MD5 hash: 96cf8eb625aefb377fd63d1adfb258e3
humanhash: wyoming-jersey-nitrogen-uncle
File name:ORDER0039348843-PO.rar
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'166'850 bytes
First seen:2021-03-08 15:07:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:/BOhYK7HQGEHgTFLfoeaxm1J/tDy5ff/W6FodmuY/apt5HVuug:JmYK7wrgBLfoPm1J/6ff/W6azt2ug
TLSH FDA533C6FF0FDE58FC8845164A6AC440972BD24B78E375B19F5E000E6EA715B1E062FA
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server2.intuya.com
Sending IP: 81.169.192.7
From: ALIMENTOS MURCIA <info@alimurcia.com>
Subject: PO
Attachment: ORDER0039348843-PO.rar (contains "ORDER0039348843-PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 15:08:09 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2z6vh7klhtcu2ooomw5yocxvhazqrlpef5pzwbgco5iubpanvjna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d67d53fd4b3cc54d39ce65bb870af5383308ade42f5f9b04c2775140bc0daa5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

rar d67d53fd4b3cc54d39ce65bb870af5383308ade42f5f9b04c2775140bc0daa5a

(this sample)

BitRAT

Executable exe 698d8eb9976de9233bd2592db30d55e72bc8da319628c00ceefbdd18084f8f86

  
Dropping
MD5 f7a9f1dccc20c28ab12936b9fb7a1500
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 698d8eb9976de9233bd2592db30d55e72bc8da319628c00ceefbdd18084f8f86

Comments