MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 304fb371fe82d75f79f5cdcb41bafa7e55561120fbce7d0e84c8da13093be433. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 304fb371fe82d75f79f5cdcb41bafa7e55561120fbce7d0e84c8da13093be433
SHA3-384 hash: 12b6381bee729f7da5292a865c30879181b538f3a84e30591bdfea29718187bf424a0cdfeb54faeaf953faab114f3532
SHA1 hash: 571a55b9009ddaa104e41a46d876eed6621119f3
MD5 hash: ce88e83885f0fb5d58c7a21f6f665399
humanhash: floor-william-lactose-hydrogen
File name:PO110629.zip
Download: download sample
File size:643'629 bytes
First seen:2020-08-05 06:30:09 UTC
Last seen:2020-08-12 10:02:00 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Rcd4Xz11SdV+9jMmlF7P9bftS224NDwFXDEbxo2NkYjenUy6fVRbThQd:20zjv9wm7Ppw34NDrdo2N9eviVXc
TLSH 06D423AD78B7753AB1D03FFC57FC9A2A11765E5C0BAB8537607800B8CAB8FA10495360
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: suntech-power.com
Sending IP: 95.211.253.210
From: Yaru Wen <Yaru.Wen@suntech-power.com>
Subject: RE: Enquiry [Purchase Order]
Attachment: PO110629.zip (contains "PO110629.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Backdoor.MSIL.Bladabindi.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/304fb371fe82d75f79f5cdcb41bafa7e55561120fbce7d0e84c8da13093be433/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 20:22:41 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gbh3g4p6qllv66pvzxfudox2pzkvmeja7phh2duezdnbgcj34qzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/304fb371fe82d75f79f5cdcb41bafa7e55561120fbce7d0e84c8da13093be433

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 304fb371fe82d75f79f5cdcb41bafa7e55561120fbce7d0e84c8da13093be433

(this sample)

Executable exe 46cb8f3e0e5bf10be49b31789332ac8a2e766a2120cb3f17d7a37ea42ef83ba7

  
Dropping
MD5 777ea33900e10cd00c36a7ee26223867
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46cb8f3e0e5bf10be49b31789332ac8a2e766a2120cb3f17d7a37ea42ef83ba7

Comments