MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fadbc6b1463c25f17f3ad6e7dfb302386e3169bccf336217d827a41b6423e35b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fadbc6b1463c25f17f3ad6e7dfb302386e3169bccf336217d827a41b6423e35b
SHA3-384 hash: 737a47c914be2569c1cac3665aadc76a894cdd60e37bb336a9a334bcf0a888ccbf34ca09c5c91347af97141f88a183d4
SHA1 hash: d043de7e66e9ffa56563810e053405ef44549f7f
MD5 hash: 2bec486fb2fa8ba69d54336bf496c448
humanhash: wisconsin-carpet-alaska-salami
File name:swiftcopy00993paymentadvic4555pdf.z
Download: download sample
Signature BitRAT
Create hunting rule
File size:1'820'172 bytes
First seen:2021-01-11 08:13:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 49152:/hPEiPgKzJuN2hTkVdU4iBPynlgxLaPXNEUZg:/hPEiPg12hTwdw7xLUXNEUi
TLSH 5F853398A8F71E0B3A69F077CD50901A1D6DB2E3E5CC037A83A571165A3379266CC7F2
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps8237.youcloud.hk
Sending IP: 203.135.139.174
From: Lin Zhu <cs@zinomall.com>
Subject: FW: TOP URGENT-Swift copy
Attachment: swiftcopy00993paymentadvic4555pdf.z (contains "SWIFT_COPY00993Payment_advic4555pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.31255.5524.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fadbc6b1463c25f17f3ad6e7dfb302386e3169bccf336217d827a41b6423e35b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 08:14:06 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ln4nmkghqs7c7z223t57mychbxdc2n4z4zwef6ye6sbwzbd4nnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fadbc6b1463c25f17f3ad6e7dfb302386e3169bccf336217d827a41b6423e35b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BitRAT

z fadbc6b1463c25f17f3ad6e7dfb302386e3169bccf336217d827a41b6423e35b

(this sample)

BitRAT

Executable exe 18da6bd51f14bd9ffca136121586de47bad598fb4652f9a48044290377fcec61

  
Dropping
MD5 344811104b9deac44b95852d3dbf89ec
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 18da6bd51f14bd9ffca136121586de47bad598fb4652f9a48044290377fcec61

Comments