MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e279bb8d76e35f624f4b6db5a7cf2aa22a7fc3a30a77b24ffdabee6a46961cd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	e279bb8d76e35f624f4b6db5a7cf2aa22a7fc3a30a77b24ffdabee6a46961cd3
SHA3-384 hash:	a8dbb7fa6eae2cd3a03bcc86791d59e3dda98cbdbffd0547ae242fc51683a646a86a07f8888a89640b3b0a156d78d990
SHA1 hash:	2e8e6e129e0e53eddda13354d8eedb1f5b2cc0d2
MD5 hash:	9fb13cf89006611b4f0f3ffcd7b4ea30
humanhash:	angel-eighteen-quebec-sodium
File name:	9fb13cf89006611b4f0f3ffcd7b4ea30.exe
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	393'216 bytes
First seen:	2022-01-01 17:52:52 UTC
Last seen:	2022-01-01 19:37:13 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:tWjcoYksyUHSvOBuFmpow1y3hBRx/LRTR/DffNoQ8wzjYAmioNxTPy16:tWzY/jOmI1TRTA0DE3
TLSH	T1F3846C1F6502CA45F65CAB70DA736F510BA6AB77C820D35BE39C67B8C42F3A9255C302
Reporter	abuse_ch
Tags:	BitRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

340

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

9fb13cf89006611b4f0f3ffcd7b4ea30.exe

Verdict:

No threats detected

Analysis date:

2022-01-01 17:58:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/094ee5a9-5b56-4271-9110-5c27d88b54bf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/217021/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1134.3011.27158.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated overlay

Link:

https://www.filescan.io/uploads/61d09503ec6c6c14a9039ba8/reports/e38f2216-43e6-4a8e-8dd4-643a117e12ea/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5803b5dd-6f9e-4c66-a09b-6579836aeef8

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/914499

Signature

.NET source code contains potential unpacker

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e279bb8d76e35f624f4b6db5a7cf2aa22a7fc3a30a77b24ffdabee6a46961cd3/

Threat name:

ByteCode-MSIL.Packed.Generic

Status:

Suspicious

First seen:

2022-01-01 17:53:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

12 of 28 (42.86%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4j43xdlw4npwet2lnw22ptzkuivh7q5dbj33et75vpxguruwdtjq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/220101-wga12shhc8/

Unpacked files

SH256 hash:

e279bb8d76e35f624f4b6db5a7cf2aa22a7fc3a30a77b24ffdabee6a46961cd3

MD5 hash:

9fb13cf89006611b4f0f3ffcd7b4ea30

SHA1 hash:

2e8e6e129e0e53eddda13354d8eedb1f5b2cc0d2

Link:

https://www.unpac.me/results/fc534bf9-8cce-485f-980d-3ea77333a9fc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e279bb8d76e35f624f4b6db5a7cf2aa22a7fc3a30a77b24ffdabee6a46961cd3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research