MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff264d7e1f11b7f9e9e01cb24a65c68a7414e4de91e6bcf178ba36ba106f7684. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevCodeRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff264d7e1f11b7f9e9e01cb24a65c68a7414e4de91e6bcf178ba36ba106f7684
SHA3-384 hash: 22a67efd4887385b54a9ce895be221649c758a3c47cc27fade0edb2274c2819b0e42f791960025ab5ea0ce99d6c8cc14
SHA1 hash: e096409b36543891e9e3df7ab30829fe67b72856
MD5 hash: 325d388e2625e047a3a51f00526a785c
humanhash: oxygen-shade-hydrogen-seventeen
File name:Code.rar
Download: download sample
Signature RevCodeRAT
Create hunting rule
File size:665'520 bytes
First seen:2021-01-12 07:19:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:aiIJMYU4VG+X7XDU4+zM5bgAb9dqcfZPhuD+RTMdJ2lzUK4DB7ZnKE3ql:CMW8EdjpTamg/qUK4DB9hal
TLSH E5E423040FF5C1311AAB55DE9EC42F2D8868381A13B999D9D5FC38E9C0796A4983F7B3
Reporter abuse_ch
Tags:Outlook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: EUR05-DB8-obe.outbound.protection.outlook.com
Sending IP: 40.92.89.42
From: beatrice dizy <dizys2@msn.com>
Subject: 6 tickets PCS de 250€
Attachment: Code.rar (contains "Code.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff264d7e1f11b7f9e9e01cb24a65c68a7414e4de91e6bcf178ba36ba106f7684/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 07:20:12 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=74te27q7cg37t2padszeuzogrj2bjzg6shtlz4lyxi3luedpo2ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ff264d7e1f11b7f9e9e01cb24a65c68a7414e4de91e6bcf178ba36ba106f7684

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevCodeRAT

rar ff264d7e1f11b7f9e9e01cb24a65c68a7414e4de91e6bcf178ba36ba106f7684

(this sample)

RevCodeRAT

Executable exe 2c2b9e423c5ae9ef99565d76a6d7d4b6d5e394f523539b447a633c803e9372a3

  
Dropping
MD5 149fdf05fd2659a44f84b7bea4ef1a8e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c2b9e423c5ae9ef99565d76a6d7d4b6d5e394f523539b447a633c803e9372a3

Comments