MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ded1c368e288aa4311863b6e7f116157ec272047db2ce79bc73f7e9e3b294254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ded1c368e288aa4311863b6e7f116157ec272047db2ce79bc73f7e9e3b294254
SHA3-384 hash: 155cb9ef45226fbe6cac22fd6f9426d5906c7f0dc74e168a57b8d8fe5a2087ee5e5204fedc6b894b4bc9d736980dc76b
SHA1 hash: d15b125ddacff73dea26b46cc314645a7a1a51ef
MD5 hash: 531c028761923cc589d3c4400475b0f7
humanhash: coffee-nevada-coffee-burger
File name:fattura di pagamento 0CV1-005444pdf.gz
Download: download sample
Signature XpertRAT
Create hunting rule
File size:583'708 bytes
First seen:2020-10-19 10:54:08 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:vA/oofbe5IpeYhMPlBKxktrb+SVUUtuRaOqaDd6YsgpD:vAAofbe5IpxMaxktX+eUaCdxDdn
TLSH 85C42393B41EB9A7F7AF1B479EACA74806B21EDF5824D3C47460D0C4F13621C9AD2539
Reporter abuse_ch
Tags:geo gz ITA RAT XpertRAT


Avatar
abuse_ch
Malspam distributing XpertRAT:

From: fatturazione@cbceurope.it
Subject: CBC (EUROPE) SRL -fatturs de pagamento 0CV1-005444
Attachment: fattura di pagamento 0CV1-005444pdf.gz (contains "fattura di pagamento 0CV1-005444pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ded1c368e288aa4311863b6e7f116157ec272047db2ce79bc73f7e9e3b294254/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 10:56:05 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=33i4g2hcrcvegemghnxh6elbk7wcoich3mwopg6hh57j4ozjijka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ded1c368e288aa4311863b6e7f116157ec272047db2ce79bc73f7e9e3b294254

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XpertRAT

gz ded1c368e288aa4311863b6e7f116157ec272047db2ce79bc73f7e9e3b294254

(this sample)

XpertRAT

Executable exe b8d430b1bdab27f5308b0f3817a50718dc72c01f0a126c44c15e0959efd3f588

  
Dropping
MD5 8fe9be96087c330447fde8a3f2e48dd9
  
Dropping
XpertRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8d430b1bdab27f5308b0f3817a50718dc72c01f0a126c44c15e0959efd3f588

Comments