MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04bf8d157357273147aefc34def653bd6ea2eb458952ecc2814f923b2bc90366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04bf8d157357273147aefc34def653bd6ea2eb458952ecc2814f923b2bc90366
SHA3-384 hash: ba1f18d416c871252ac3f485675c0ef6a198ac88361b55e359075f6f5720e6c391cef0f31531c7bb90169f5e35dbbeb1
SHA1 hash: c594d691980c875e67f66f7c1a90154ab8ef94b0
MD5 hash: 8d2e6e00966ede33ade66c597362eb35
humanhash: bakerloo-uniform-nebraska-timing
File name:Profoma68570 -334699~200810 PAYMENT SWIFT COPY Bank_print-out.img
Download: download sample
Signature Matiex
Create hunting rule
File size:1'572'864 bytes
First seen:2020-10-19 07:08:46 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:h6li2GG0dEvPqTkGkpI5fqdKKGWpfXNECReP6os+sVg:hYTqTkGkuAJXNEouZsa
TLSH 3375AE467040F027E28F28B51E2AED607571BB7E4464821CB1DB7A1EC7E33962C9EDD9
Reporter abuse_ch
Tags:img Matiex


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: atl4mhob17.registeredsite.com
Sending IP: 209.17.115.110
From: orders <orders@echoproducts.com>
Reply-To: orders <orders@echoproducts.com>
Subject: Fwd: GRUPO CY. PROFOMA WIRE TRANSFER
Attachment: Profoma68570 -334699~200810 PAYMENT SWIFT COPY Bank_print-out.img (contains "Profoma#68570 -334699~200810 PAYMENT SWIFT COPY Bank_print-out.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.24284.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04bf8d157357273147aefc34def653bd6ea2eb458952ecc2814f923b2bc90366/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 04:34:17 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=as7y2fltk4ttcr5o7q2n55stxvxkf22frfjozqubj6jdwk6janta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04bf8d157357273147aefc34def653bd6ea2eb458952ecc2814f923b2bc90366

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

img 04bf8d157357273147aefc34def653bd6ea2eb458952ecc2814f923b2bc90366

(this sample)

Matiex

Executable exe 404f5e208504a3cc7541fffb203db6bd135373f0ae0b9dc88d84e57464539dc5

  
Dropping
MD5 ac184148a35fe6692f8b54c64eb94eb6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 404f5e208504a3cc7541fffb203db6bd135373f0ae0b9dc88d84e57464539dc5

Comments