MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba1ec753aea2ae9524653d5649fcd0eb681dba5baf0426b5e020b8c7ccf8c8b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba1ec753aea2ae9524653d5649fcd0eb681dba5baf0426b5e020b8c7ccf8c8b0
SHA3-384 hash: 53d765c6e25dcb78995c82b9a888aaf11937d9ef757b1ae2535f23473e411f1a1046b6b01c99ecdea3fe7ddcfaa378ea
SHA1 hash: b75f6142661f57cb1c8d1a2d8d78f49f7d0d069f
MD5 hash: 4c5a85d72142793fdc10d319721a95e6
humanhash: april-one-paris-whiskey
File name:Proforma Invoice.zip
Download: download sample
File size:484'110 bytes
First seen:2020-08-18 11:15:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:y8w4k0I1673l9jhM827++hU8qW2TSFC+6MlAqeQKiD8:y8w8Iunhe++htZLwMhGiD8
TLSH 94A423C7B00ECDCADBE16B02526FDA3F9482BD246706306E976355440BC9E2523EBDE5
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx.yiqioachina.com
Sending IP: 64.227.86.17
From: jum@yiqioachina.com
Subject: Re:OVERDUE PAYMENT
Attachment: Proforma Invoice.zip (contains "Proforma Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21926.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba1ec753aea2ae9524653d5649fcd0eb681dba5baf0426b5e020b8c7ccf8c8b0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:17:07 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xipmou5oukxjkjdfhvlet7gq5nub3os3v4ccnnpaec4mpthyzcya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip ba1ec753aea2ae9524653d5649fcd0eb681dba5baf0426b5e020b8c7ccf8c8b0

(this sample)

Executable exe 7a236571cd43d05a4ac6beaedeb425c563913b2194b12345a1438755d3beea24

  
Dropping
MD5 7393ef8aba37bdfe8499a4cf57a5458f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a236571cd43d05a4ac6beaedeb425c563913b2194b12345a1438755d3beea24

Comments