MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec3179a06f11567a21907d9a24abb57a081719d3f33d6f6f634a026364252b75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec3179a06f11567a21907d9a24abb57a081719d3f33d6f6f634a026364252b75
SHA3-384 hash: c1aca58a6df9d6260b4d7bba429b030192b2c8e291ad8e3e3228fcf93e7ac6a948917a828a8a7bba9f715cd851789ff1
SHA1 hash: b8d8c6c18cc584b54fad152b3352322da66a16c9
MD5 hash: 78577a13faf3ad6e5bf3ab625aeb0b83
humanhash: green-black-bulldog-grey
File name:Our New Order No. 1557174.zip
Download: download sample
File size:433'355 bytes
First seen:2020-05-12 09:14:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:PsUuqP2xMCvA87FtNvFky3m4QUZGsv7VZZfRAwnNTCiXpQqOqRsvXLnm6H:PsUr2uCJFf0U0wfRAliSWsTnmu
TLSH 9694234B4DF4F1ADD619E57A721B317A300867D6F010FCEAE12AA4378FB91928D37291
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.netsiter.com
Sending IP: 188.240.2.154
From: David Zhang <info@nnmed.com>
Subject: RE: AW: Our New Order No. 1557174
Attachment: Our New Order No. 1557174.zip (contains "Our New Order No. 1557177.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qyxtidpcflhuimqpwncjk5vpiebogot6m6w633djibggzbffn2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip ec3179a06f11567a21907d9a24abb57a081719d3f33d6f6f634a026364252b75

(this sample)

Executable exe aad3b8a87d1932384a6d1c2869b9138ce79d78b3bfc2cd61324e1a833f5f967a

  
Dropping
MD5 7465c858f289dcb4dc2257d546677545
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aad3b8a87d1932384a6d1c2869b9138ce79d78b3bfc2cd61324e1a833f5f967a

Comments