MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevCodeRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d
SHA3-384 hash: 93f4d63149b33a18c894c1af515ec4edb748fd62dae7c6de4f12a8f26ed60df8c7315cc69e6624b92db5201dc3e68d15
SHA1 hash: 50aa921431f32e6378b855eb7153eb4e311a52d1
MD5 hash: f929c9ea28ed89d0db312df5a284545c
humanhash: black-william-alanine-tennis
File name:NEW PURCHASE ORDER.uue
Download: download sample
Signature RevCodeRAT
Create hunting rule
File size:795'635 bytes
First seen:2021-08-12 05:41:38 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:66LW+AyqCBjA7wDLK12xY4ymLoYEPTagy:8/yq8hLK14QdPTi
TLSH T18D05333E6CDBB1DC1AF945F842A1EB750263B8EB5F5DA91C0C272A9EA43197F3463110
Reporter cocaman
Tags:uue


Avatar
cocaman
Malicious email (T1566.001)
From: "peter@coscocompany.com" (likely spoofed)
Received: "from ip207.ip-51-68-133.eu (ip207.ip-51-68-133.eu [51.68.133.207]) "
Date: "11 Aug 2021 05:45:56 -0700"
Subject: "RE: REMINDER"
Attachment: "NEW PURCHASE ORDER.uue"

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 03:56:17 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bppizbyxd3fminy77xoakvkdxmvwahaji3q6euxp5jakf2jcawq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevCodeRAT

uue f85ef46438b8f65621b8ffeee02aaa1dd95b00e04a370f12977f52051749102d

(this sample)

RevCodeRAT

Executable exe 142cf7f01ff7c99da5e16196325e3fa3a6d867ff0e50696d727c92696ba97ccf

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 142cf7f01ff7c99da5e16196325e3fa3a6d867ff0e50696d727c92696ba97ccf

Comments