MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4934ffbb1080a9609a8c524823f5e0bd1657cde64b282098f7c9d369ae9fe694. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4934ffbb1080a9609a8c524823f5e0bd1657cde64b282098f7c9d369ae9fe694
SHA3-384 hash: 116c27d8ee6d2daae8e0d26624435245aba5bbc48a557c92165aa130dbfbc42795765c9731d2ad0dd81c30c6155b7d57
SHA1 hash: 33d26c4d2435c135ff42506c6db64d9e50c66a13
MD5 hash: 5b77e534b0b023a5ad4e094183717130
humanhash: hydrogen-may-pluto-sink
File name:ups_details.iso
Download: download sample
File size:1'835'008 bytes
First seen:2020-06-10 15:01:07 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:vaXcbtJOhBn2j4byGtIW3n0jlioooooooooooooooo:vaXqO2sby5xioooooooooooooooo
TLSH 3B856C22B7914C33C1331A3DDC5B9679E82ABE511A24A8C62BF83D789F75341392D1B7
Reporter cocaman
Tags:iso


Avatar
cocaman
Malicious email
From: "UPS Customer Service" <customer@ups.com>
Received: from dddd0.eastus.cloudapp.azure.com (unknown [52.149.224.84])
Date: Wed, 10 Jun 2020 14:08:41 +0000
Subject: UPS - Pending delivery
Attachment: ups_details.iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 15:03:04 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=je2p7oyqqcuwbgumkjech5paxulfptpgjmucbghxzhjwtlu742ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

iso 4934ffbb1080a9609a8c524823f5e0bd1657cde64b282098f7c9d369ae9fe694

(this sample)

Executable exe 40e95520d719a9c3277c76b42124de197dc391210b1053fa505897838dcdcb90

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 40e95520d719a9c3277c76b42124de197dc391210b1053fa505897838dcdcb90

Comments