MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd98d99311ac88525059f9f3502c6c98803298470e4d8296281de197bc649bb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MSILStealer


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd98d99311ac88525059f9f3502c6c98803298470e4d8296281de197bc649bb4
SHA3-384 hash: ad500fcb327d73114585bbca22ffe5e8103c6dc90a1c9992da09b46073cfd6642d3be82e94b60a7d669d6260db57f3a4
SHA1 hash: b54c2fe8c5c53f69e2ab50ba4c3ccdc8ae48fcdf
MD5 hash: 9a33f0b9f296e1a1d15f079937acba67
humanhash: fix-minnesota-edward-purple
File name:payment method changes.rar
Download: download sample
Signature MSILStealer
Create hunting rule
File size:255'500 bytes
First seen:2020-05-11 07:41:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:sHzFahm3bYMY3XvouKfOmrBOdl2ZGZXpMLyE4YjSWErfE:EzFmmfOmrBOd8wHETErs
TLSH 52442278B22D13C6D9E5DD3661E0D8BBD1BF74072339C724AEB46746A35860B5C8B28C
Reporter abuse_ch
Tags:MSILStealer rar


Avatar
abuse_ch
Malspam distributing MSILStealer:

HELO: mail.hisamitsu.co.id
Sending IP: 103.93.54.41
From: SINSPEC Services Pte Ltd <agung.ariyanto@hisamitsu.co.id>
Subject: Re:Re: Friendly greetings and payment method changes...
Attachment: payment method changes.rar (contains "payment method changes.exe")

MSILStealer FTP exfil server:
ftp.lopeztradingllc.com:21

MSILStealer FTP exfil user name:
chiefoo@lopeztradingllc.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 03:16:00 UTC
File Type:
Binary (Archive)
Extracted files:
395
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wmnteyrvsefeucz7hzvaldmtcadfgchbzgyffridxqzppdeto2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MSILStealer

rar fd98d99311ac88525059f9f3502c6c98803298470e4d8296281de197bc649bb4

(this sample)

MSILStealer

Executable exe 267126396c3c2edf406eecf6072b3acbee74dfbde7630cd184b9824ed18aac92

  
Dropping
MD5 0c05bd1016416bddf4e08f322d9a8e99
  
Dropping
MSILStealer
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 267126396c3c2edf406eecf6072b3acbee74dfbde7630cd184b9824ed18aac92

Comments