MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

@abuse_ch

Malspam distributing SnakeKeylogger:

HELO: cloudhost-2248786.us-midwest-1.nxcli.net
Sending IP: 8.36.41.62
From: Nguyen Thi Loan <loannt1@imecovn.com.vn>
Subject: 新订单_WJO-TT180
Attachment: appprovedWJO-TT180,pdf.iso (contains "(appproved)WJO-TT180,pdf.exe")

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

36

Origin country :

FR

Mail intelligence

Geo location:

Global

Volume:

Low

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL

Alert

Create hunting rule

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87

CERT.PL MWDB

Detection:

n/a

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.Zmutzy

Threat name:

ByteCode-MSIL.Trojan.Zmutzy

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-02-23 01:50:41 UTC

AV detection:

9 of 47 (19.15%)

Threat level

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://www.spamhaus.org/query/hash/ks266ye2jluvhfae6jgbe6puccgym7s5xgxsghdz4l524wwu3odq._file

VirusTotal 25.42%

AV coverage:

25.42%

AV detections:

15 / 59

Link:

https://www.virustotal.com/gui/file/54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87/detection/f-54b5ef609a4ae9539404f24c1279f4108d867e5db9af231c79e2fbae5ad4db87-1614047720

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00