MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9704d0420f573639eed3b1765ea5f212ba4c3129333f2efc167a1c0724935419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9704d0420f573639eed3b1765ea5f212ba4c3129333f2efc167a1c0724935419
SHA3-384 hash: 0a22fb1553d9a361d366d4ccff7cea6d55cd503a3f02310dfd8a63eb617af60b4b89e521765cf988ee7d33d4e589a57e
SHA1 hash: 1bcb34285ed34acac187f855aca82031700e436d
MD5 hash: 947a5ab25da9690a9dfe9fa185b5ebfd
humanhash: green-triple-december-mississippi
File name:New Orders.ace
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'704'338 bytes
First seen:2020-07-16 06:37:48 UTC
Last seen:2020-07-16 06:38:04 UTC
File type: zip
MIME type:application/zip
ssdeep 49152:xkbxZfzNc08Ui4+AwVTkaXx7ghm9uivBb1DYbK9sc4:ONZfe08Ui4Ojx8hbivs+L4
TLSH A88533C677DB505D6359A3A336FCEE788E502574A54C638EDCC6CF00A7A3687A934883
Reporter abuse_ch
Tags:ace HawkEye Yahoo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic305-49.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.185.175
From: benco incorporated <dougles_g_russell@yahoo.com>
Reply-To: bencoincorporated@yahoo.com
Subject: About Shipment
Attachment: New Orders.ace (contains "Itemslists.scr")

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23348.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23380.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23382.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9704d0420f573639eed3b1765ea5f212ba4c3129333f2efc167a1c0724935419/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:39:07 UTC
AV detection:
11 of 42 (26.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s4cnaqqpk43dt3wtwf3f5jpsck5eymjjgm7s57awpioaojetkqmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

zip 9704d0420f573639eed3b1765ea5f212ba4c3129333f2efc167a1c0724935419

(this sample)

Matiex

Executable exe 1b68f5ab26d4fd7c7ca1933dd8dcc6f6f879104a072dc92f9d5917ad42a3cfd7

  
Dropping
MD5 b95e010955432d3e5a2e63d54c01e1b2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b68f5ab26d4fd7c7ca1933dd8dcc6f6f879104a072dc92f9d5917ad42a3cfd7
  
Dropping
SHA256 6e9b80abff99f9ce1d477c30f23c7ab327c1d5fef3edda5f68497aacd35ae03b
  
Dropping
MD5 281198c4b0cf5277fb57896af997ada3

Comments