MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BitRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522
SHA3-384 hash:	4a9aa4aba891da70ae2f5cfa2a733084dfbd58a2d5e5bdae72e8f4da86ae26801e5fd6a2303f8358b8d0ca27e342a3b9
SHA1 hash:	814edf875e06cfa42ba929d13704b39d932a7eac
MD5 hash:	76a5c25479b47b6bca63ffeafd3043d5
humanhash:	mike-bluebird-high-oklahoma
File name:	SAMPLE_P.LNK
Download:	download sample
Signature	BitRAT Create hunting rule
File size:	3'666 bytes
First seen:	2021-06-07 05:37:02 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/octet-stream
ssdeep	48:8wHa6xP/qMTRNPzZt2htgC1UHh6Z3urdtaOe9bgIZabM:8wHXxHqMTRNPNcraHauryxg2
TLSH	0771921852E95709E2B6EB31A9FE6212F9727E67F5139B6D1083420E05B0100F5DBF3E
Reporter	0x3c7
Tags:	BitRAT crime lnk RAT

Intelligence

File Origin

# of uploads :

# of downloads :

129

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Details

Hidden Powershell

Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522/

Threat name:

Shortcut.Trojan.Wacatac

Status:

Malicious

First seen:

2021-06-01 22:58:07 UTC

AV detection:

13 of 29 (44.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xnbsl2ojx5ww4uk5ymcduil5rwwr6zbezwogk3ir2gk46eyuura._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_generic_LNK_uid_Jun2021_1 Create hunting rule
Author:	Nils Kuhnert
Description:	Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.

Rule name:	EXE_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies executable artefacts in shortcut (LNK) files.

Rule name:	Long_RelativePath_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.