MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e6651df0567509688b663f48e034f6f5b37ec05c5fccf4843efef9a5b863d11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e6651df0567509688b663f48e034f6f5b37ec05c5fccf4843efef9a5b863d11
SHA3-384 hash: 01389ae3eb19cf6d991496efe1f6d53d8ebc62d99523b40cfba496c9ad13de78b6590ad354616264215abbf4aff48750
SHA1 hash: 72455435864ff0e4e8650fe061bb0774906f9c04
MD5 hash: 52970ddc009493a877075424bf33b4ec
humanhash: fanta-alpha-eight-cola
File name:invoice _25280.zip
Download: download sample
Signature Matiex
Create hunting rule
File size:703'543 bytes
First seen:2020-10-12 05:47:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ovPniOV6me5h7f+fHL7ydBo1edJfUCAbiYsgUAObQF:ov/n8mkh7f67OBo1efUCAbhsdAOEF
TLSH 10E423FE13EC89659B017D9CBF2D9C4E85CA760038A7389974A2FF9DC8C8494B50B463
Reporter abuse_ch
Tags:Matiex zip


Avatar
abuse_ch
Malspam distributing Matiex:

HELO: dd24812.kasserver.com
Sending IP: 85.13.146.44
From: info@badrenovierung-ehmann.de
Subject: Re: Payments - October Invoices
Attachment: invoice _25280.zip (contains "invoice _25280.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e6651df0567509688b663f48e034f6f5b37ec05c5fccf4843efef9a5b863d11/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:38:08 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bztfdxyfm5ijncfwmp2i4a2pn5ntp3afyx6m6scd57xzuw4ghuiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/0e6651df0567509688b663f48e034f6f5b37ec05c5fccf4843efef9a5b863d11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 0e6651df0567509688b663f48e034f6f5b37ec05c5fccf4843efef9a5b863d11

(this sample)

Matiex

Executable exe 0f3094ef68f204dacf3e33e058793b3251df3f8bf73a1b720e631406593a6c28

  
Dropping
MD5 ecfc670d83d3dc478c09107063033be9
  
Dropping
Matiex
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f3094ef68f204dacf3e33e058793b3251df3f8bf73a1b720e631406593a6c28

Comments