MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381
SHA3-384 hash: c3d451ef9fcb97e2ff1b4ab80a9ad42e8ad0e560f97f14e13a906d25593ed492dff242bcf7c65fbfa72309e512d55335
SHA1 hash: fd69adb4f1f9dde21564c020ea2feb0686bf91f1
MD5 hash: 019b25421881e6c8e15b36a5c2a9e9fd
humanhash: princess-magazine-texas-helium
File name:PAYMENT_FROM_OUR_SBI_BANK.zip
Download: download sample
File size:350'131 bytes
First seen:2020-08-18 12:28:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:309BXtLL5H+dvQGR7aognYP4GNA91mH3/VC4Y3h69l6bkCuhQ+S0y+lq2HTonevj:309ZW4QP4QA91mX/6hM5W+S08Oknv7Yt
TLSH 9674236C3E0B8FC9DAE938BD9F23E4A6025242F71748A0595689B3F3C05A54BF55780F
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pro152-51.mxout.rediffmailpro.com
Sending IP: 119.252.152.33
From: Perfect Tubes Ltd <deepak.naik@perfecttubes.com>
Subject: We have transferred  an amount of Rs.11,98,733/-
Attachment: PAYMENT_FROM_OUR_SBI_BANK.zip (contains "PAYMENT FROM OUR SBI BANK.cmd")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.43883.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381/
Threat name:
Win32.PUA.Vigua
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:30:08 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsk6khtt6wfi2d6xnda3heq6ge75vae2eh4gjh6xzd4eeajkkoaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 5c95e51e73f58a8d0fd768c1b3921e313fda809a21f8649fd7c8f842012a5381

(this sample)

Executable exe b2db0dad3f1acb31633bc8d135453b5141d75ce89212a303a9148a40f60eb917

  
Dropping
MD5 d554b4c1aa278eeaf10def8ea5973cd6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b2db0dad3f1acb31633bc8d135453b5141d75ce89212a303a9148a40f60eb917

Comments