MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f24d6c5bcfe6c158e99f82f4ddf5cb29dbe528b558cbc9613f7fa9a21189a56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f24d6c5bcfe6c158e99f82f4ddf5cb29dbe528b558cbc9613f7fa9a21189a56
SHA3-384 hash: 33d4bfffef893129a7fa8b5468e20dba577d3e4cfacf4037ff812e61bf7a970205778e542983bab732c7fe1c669acd52
SHA1 hash: 2d3a5dbd343f44ffc4d8077394cc0471b89b991e
MD5 hash: 8f72ebab102309e29ff73c8379d89f27
humanhash: cat-romeo-arkansas-kilo
File name:New_Order.zip
Download: download sample
File size:1'491'090 bytes
First seen:2020-05-19 05:47:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:0zDfkwV/Od4LYArSkotgmgPmgYA6eCz4lBPaNbTmlbmcv6ybcWeTOFfG:6Dfk8/dLYArSNGmae4jPaNvmlbmcvcau
TLSH 5C6533195940042B3EB4EEF633A767D4B684CF60D319CF260DC69619C8B1DA66B3713B
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: discuss.bayton.org
Sending IP: 94.237.42.172
From: Faisal Sheikh <chad@greysuitretail.com>
Subject: RE:RE:RE:Purchases Order
Attachment: New_Order.zip (contains "el.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 10:55:54 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4snnrn47zwblduz7axu3x24wko34uulkwglzfqt675juiiytjla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 2f24d6c5bcfe6c158e99f82f4ddf5cb29dbe528b558cbc9613f7fa9a21189a56

(this sample)

Executable exe 2e3068fbfcc72172efda05ac44c3a23658d575a9125abefa62e42eb3c0983df1

  
Dropping
MD5 b46dde700c1401b374e381f300e21caa
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e3068fbfcc72172efda05ac44c3a23658d575a9125abefa62e42eb3c0983df1

Comments