MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15175b0b6c75772a249df946760f4902399142ea4b62049084d114a326ffa376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15175b0b6c75772a249df946760f4902399142ea4b62049084d114a326ffa376
SHA3-384 hash: cae511edffb2ef4d004449127c5522b7b86c054a81c4eaf03b841631f4aae07c6a29e8488173ae95557c6757098eed24
SHA1 hash: db861e6dea749b8a6418f9d273a8737a8058d58e
MD5 hash: a10b1d0fcd52080bcea23cfeb8a82e46
humanhash: black-don-rugby-video
File name:IATA.zip
Download: download sample
File size:529'158 bytes
First seen:2020-05-21 07:38:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:DQy89+mVPLulapDkIVu0Gtae4GgUP3voqa80NfQjohb7hIpPrVniT7SPcI:g+mVPSqkIwNtae4GgdqadNf4ohb7h4rh
TLSH C8B423D42E1ABD75DEB0D9BC7F4D167B09688D33AF29DAFE16B03406C183C65E096890
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.dom-express.ru
Sending IP: 87.103.212.119
From: S7 Airlines <supp@s7.ru>
Subject: новый валидатор IATA во вложении
Attachment: IATA.zip (contains "IATA.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Generic.mg.7118444d587a1d65.31770.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Hesv
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 08:36:13 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=culvwc3mov3suje57fdhmd2jai4zcqxkjnrajeee2ekkgjx7un3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 15175b0b6c75772a249df946760f4902399142ea4b62049084d114a326ffa376

(this sample)

Executable exe 118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1

  
Dropping
MD5 1b9e5b3ce524614941d69bfc00db57b5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1

Comments