MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed608fdcfdc9f197a859950ec585539bf0f6a13f83e50887837bd0bbb338476d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed608fdcfdc9f197a859950ec585539bf0f6a13f83e50887837bd0bbb338476d
SHA3-384 hash: 26a3de91f4341129857a6d2751c881734c6d124d8f08f7634ce6fab850531829005f0230d8222074e83137273b397934
SHA1 hash: 0b4a4f835546617fe7718d22773223520fe5e7db
MD5 hash: dc2f23454ac82c4062bede950ff365f3
humanhash: mirror-twelve-kilo-delta
File name:SWB-HP_12.03.2020.pdf.jpg.img
Download: download sample
Signature BitRAT
Create hunting rule
File size:2'490'368 bytes
First seen:2020-12-03 17:36:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:vk3XYKwtovNso0Yg048sx9/8VLQYHU1ZT:MYKwvoW0lsx9/8VLe1
TLSH D9B5CE9C360076DFD867CD7289681C64FB90ACBB475BD603A05326ECAA6D49BCF140F6
Reporter abuse_ch
Tags:BitRAT DEU geo img RAT UniCredit


Avatar
abuse_ch
Malspam distributing BitRAT:

HELO: mail2.om18.serverdomain.org
Sending IP: 89.107.188.4
From: Unicredit Bank GMBH<commercial@unicreditgroup.eu>
Reply-To: commercial.rlavel@gmail.com
Subject: Zahlungsaviso
Attachment: SWB-HP_12.03.2020.pdf.jpg.img (contains "SWB-HP_12.03.2020.scr")

BitRAT C2:
jegebit.duckdns.org:43360 (193.239.147.22)

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed608fdcfdc9f197a859950ec585539bf0f6a13f83e50887837bd0bbb338476d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 17:37:05 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5vqi7xh5zhyzpkczsuhmlbkttpypnij7qpsqrb4dppilxmzyi5wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed608fdcfdc9f197a859950ec585539bf0f6a13f83e50887837bd0bbb338476d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

img ed608fdcfdc9f197a859950ec585539bf0f6a13f83e50887837bd0bbb338476d

(this sample)

BitRAT

Executable exe 3e483d19170652c8c74d9a42ef17804b4739e6290f08e54c68f8311e390b0c1f

  
Dropping
MD5 628d42e07e7293f87ddc73c825825f14
  
Dropping
BitRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3e483d19170652c8c74d9a42ef17804b4739e6290f08e54c68f8311e390b0c1f

Comments