MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d8089aca66ea177d0b5ed4c1a79c2426fb9620341086de548a7026da11423c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14d8089aca66ea177d0b5ed4c1a79c2426fb9620341086de548a7026da11423c
SHA3-384 hash: 8e183704ccbb8473204efb109bfdb450e0488f88841dfddcd89c76f9bc7031ca0a67dc4be901e7bc368ee5b64fde5980
SHA1 hash: 105bc72334a95faf1527bdb0d4e0c5767c3c7808
MD5 hash: 25c10667978a8d911877510e91912d6f
humanhash: avocado-carpet-blossom-eleven
File name:PO.zip
Download: download sample
File size:605'442 bytes
First seen:2020-10-16 10:28:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:PYUdNGSILEMJeUm+Rq7U6hSUXtE6Q1j24ylALbhnxZiv87nrjApJHh:PYIpaJnm+RaE6KylALQv8zgrB
TLSH D5D423DD3362CCF89DA1DA63553BCA73B7F6AE797942909033E10436A1AB3053DA8149
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.zaretyqq.tk
Sending IP: 188.225.82.58
From: Raut Suraj (Sales Engineer) <sales@mla-sales.com>
Subject: PURCHASE ORDER
Attachment: PO.zip (contains "FfgvYUp3A8PluWu.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14d8089aca66ea177d0b5ed4c1a79c2426fb9620341086de548a7026da11423c/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 11:00:28 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctmargwkm3vbo7ill3kmdj44eqtpxfragqiinxsurjycnwqrii6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14d8089aca66ea177d0b5ed4c1a79c2426fb9620341086de548a7026da11423c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 14d8089aca66ea177d0b5ed4c1a79c2426fb9620341086de548a7026da11423c

(this sample)

Executable exe 4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572

  
Dropping
MD5 140c9507813e636c2c3d497e7d5b7633
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4fe62c19cbb43d22b3116e7d7d3fb26c3d5bdfbfc5731fc5bde238aea6e98572

Comments