MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b3f1d38ebf562468ecb35248f517976d119812dfb7373139c8225318083402. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45b3f1d38ebf562468ecb35248f517976d119812dfb7373139c8225318083402
SHA3-384 hash: b4fbb1f8730dab821e0e88fe2744aae3728a3a43ae658c2bcc8dc21117cf3cc70046383acc7c6a3daf8334ec8cd498e9
SHA1 hash: bb92598a18ab5c8ae86e571354da4eaa37067e55
MD5 hash: dd7d9386845d824c9c676ff732bef1cf
humanhash: nebraska-hamper-neptune-oranges
File name:Payment.zip
Download: download sample
File size:411'700 bytes
First seen:2020-08-18 12:13:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BTI8bFaAtx/C2oXEqwlv24GmYLXGqPcK5eD9RAIMoK:Bbhvx84GmYLdb1
TLSH B0942391520757EAACB37BC77F47033CAF02D91489E7678177B129E8B0AC26E3651AC1
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gokosha.co.jp
Sending IP: 185.222.58.144
From: Jennifer Phuong (Ms) <chan@gokosha.co.jp>
Subject: PO - RFQ # 202055 PO 2020764
Attachment: Payment.zip (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21669.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45b3f1d38ebf562468ecb35248f517976d119812dfb7373139c8225318083402/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 02:00:14 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iwz7du4ox5lci2hmwnjer5ixs5wrdgas363tomjzzarfggaigqba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45b3f1d38ebf562468ecb35248f517976d119812dfb7373139c8225318083402

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 45b3f1d38ebf562468ecb35248f517976d119812dfb7373139c8225318083402

(this sample)

Executable exe 03bd2e000f7901a07affedeac4d001a701bb3b1d6f332cde9314d156cc7689ac

  
Dropping
MD5 d6c8918151f310aac3444047553ef711
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 03bd2e000f7901a07affedeac4d001a701bb3b1d6f332cde9314d156cc7689ac

Comments