MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d
SHA3-384 hash: 22260901108dd152a835c223f09bf8ef4ecba8434f1cb5c5265ad78e7b52a74a7a917d4cde200a01062c28a312d59c04
SHA1 hash: 0c0dc8063b1378c04870ab686716be1f2c0cbd98
MD5 hash: 3fb10b7d82fec72c138979af201d6fe3
humanhash: juliet-eight-missouri-three
File name:Products List.pdf.arj
Download: download sample
File size:18'377 bytes
First seen:2024-09-25 06:39:40 UTC
Last seen:2024-09-25 06:41:37 UTC
File type: arj
MIME type:application/x-rar
ssdeep 384:NDeeSWOdTuf186oFaWVKpgR2vQN0yH53Q/+H+qjybBBMUafbHUKiiDk9b1:EeudTuf186oFaWkp34Z9zILMUkHT5AZ1
TLSH T1DC82E1DE4CF135D091D6F3F186B54A6EFE1C9D2C68003D6C7BD7580E823C8AB56A4848
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter cocaman
Tags:arj


Avatar
cocaman
Malicious email (T1566.001)
From: "Wini-W&D < wini@weilyandduckgroup.com >" (likely spoofed)
Received: "from weilyandduckgroup.com (unknown [185.222.58.79]) "
Date: "24 Sep 2024 21:47:08 -0700"
Subject: "TOP URGENT// Inquiry for Material"
Attachment: "Products List.pdf.arj"

Intelligence

File Origin
# of uploads :
9
# of downloads :
74
Origin country :
CH CH
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Products List.pdf.scr
File size:40'960 bytes
SHA256 hash: 86ea9ea45a530191cb5f42b3336b00cfb92dd219f0861e5dc9dac7f5d1e48232
MD5 hash: 4e783011f451168c8c75229518d350a6
MIME type:application/x-dosexec
File name:32512
File size:20 bytes
SHA256 hash: a14e70ed824f3f17d3a51136aa08839954d6d3ccadaa067415c7bfc08e6636b0
MD5 hash: 3c68f77c35c26ff079a1c410ee44fa62
MIME type:application/octet-stream
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20240925-0432.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66f366705346c7b922ade054
Tags:
Stealth Kryptik Underscore Kryptik Micro Msil
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d/
Threat name:
ByteCode-MSIL.Spyware.Snakekeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-09-25 03:10:21 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 24 (79.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkpm22eo66lleehbrd4abcbjdooy3t6yed4a6xrmwxjfxsuncwoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

arj 0a9ecd688ef796b210e188f80088291b9d8dcfd820f80f5e2cb5d25bca8d159d

(this sample)

SnakeKeylogger

Executable exe 86ea9ea45a530191cb5f42b3336b00cfb92dd219f0861e5dc9dac7f5d1e48232

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86ea9ea45a530191cb5f42b3336b00cfb92dd219f0861e5dc9dac7f5d1e48232

Comments