MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 185da05786d6028eff22b5748184651bcd2954560679f89186d4cd3757bc07fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 185da05786d6028eff22b5748184651bcd2954560679f89186d4cd3757bc07fb
SHA3-384 hash: 787a46ba409a444289a9c469263c15d51a1224ebfbf14ddb6f755df625e88872e63a41d29ad57995ff63a345087c8b8d
SHA1 hash: d4fa4f9e813dd02500fb913d54224e9151070741
MD5 hash: 704330f5d8165d991b5e7845d6aad790
humanhash: jupiter-island-virginia-salami
File name:Shipping Doc.zip
Download: download sample
File size:389'978 bytes
First seen:2020-08-18 05:33:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+aiv7+CuBNxLljuKldE/1Gb6x4VJt0WFXQ/PEn1RZkzNJHi8DCtr/XQQ4qhuh99V:zG7hu3GKldE4b6xCJt0WFg/P81X+i8Dh
TLSH A08423E7AEA54EC7EC1A377A6AD3C054B9ECC9F163D718222505DA69040F1E38463FE4
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email
From: DHL<kerlos.awadallah@orascomhd.com>
Received: from orascomhd.com (unknown [185.222.57.205])
Date: 17 Aug 2020 16:11:08 -0700
Subject: [Delivery] Cross Check Your Delivery Address BL/Inv/Pack list-DHL Tracking
Attachment: Shipping Doc.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25374.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/185da05786d6028eff22b5748184651bcd2954560679f89186d4cd3757bc07fb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 21:18:13 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dbo2av4g2ybi57zcwv2idbdfdpgssvcwaz47remg2tgtov54a75q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 185da05786d6028eff22b5748184651bcd2954560679f89186d4cd3757bc07fb

(this sample)

Executable exe fb764def7db7639577aaf3991926ccfc30be6720af017184c729e4c6733e15b4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb764def7db7639577aaf3991926ccfc30be6720af017184c729e4c6733e15b4

Comments