MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd
SHA3-384 hash: 932b6cb784891bdf9f361c82898e70b97cd49f4efb45064e7491702bc4fe129ece680d80e95ffa3733386f6a687eec49
SHA1 hash: db9f9d90aff33e06e7e28bbee1e2fb59b48cf6c5
MD5 hash: 120e64a8a2f32751de5ac49daa0dcbd1
humanhash: cat-wyoming-uniform-victor
File name:PO.rar
Download: download sample
Signature Matiex
Create hunting rule
File size:907'586 bytes
First seen:2020-08-05 09:10:06 UTC
Last seen:2020-08-05 11:35:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:vT/jgIfy7JPg3logGMG+hbtjWME61jbzN0+U4K:vTsIkC0UZE61jbzNrFK
TLSH 0415336D1EF9904C2FA94041BA606DAFEDD1606CDE0B1A489F423FA3D3609815DF69CF
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: [103.140.250.133]
Sending IP: 103.140.250.133
From: Lu Thai Textile Co Ltd <Noortext.mills@hotmail.com>
Reply-To: Noortext.mills@hotmail.com
Subject: NEW PO.
Attachment: PO.rar (contains "PO.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:25:00 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6eisb2ah25o4me6pet4ols6xvvmvalsbh6ruwum5kqlakarn7gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

rar 0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd

(this sample)

Matiex

Executable exe fc1ca8b0fe8eab2d98c0f0e7ad37108f836fff77b50e393cf5dee61b7e4e6eb0

  
Dropping
MD5 e34037661a1608c722e5264797b2eecf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc1ca8b0fe8eab2d98c0f0e7ad37108f836fff77b50e393cf5dee61b7e4e6eb0
  
Dropping
SHA256 e68cce62fb85b2349c45eb042fa02fc55da099883441c1cd79bac8132680a09d
  
Dropping
MD5 07717e9884997d9f6a94216331598047
  
Dropping
SHA256 347be975b764b78ec7860ee7c61c443fb63d6d330e7897acb8ac701cf37bb685
  
Dropping
MD5 5c0efa906b43ad42826a5fa894fa8b95

Comments