MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15b02389340ff546a4d0fc4c94b534b7e5e2711ded3992901043f6e6199694af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15b02389340ff546a4d0fc4c94b534b7e5e2711ded3992901043f6e6199694af
SHA3-384 hash: fb7e53e930b44bf850bb032fc7745c1c1427413d67bd8c9657c29345dc1f66ef9b23388cb8dc9b2962509209ec7d1b45
SHA1 hash: e70bd641cbed388b58742ec9d591d81e6b4a5cb2
MD5 hash: a0da8a652e2249d36b05e9f2f7c18565
humanhash: may-iowa-rugby-winter
File name:Payment_Receipt_pdf.gz
Download: download sample
File size:461'311 bytes
First seen:2020-11-04 14:20:22 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:pQ7+tywpfMWy+1IlqcwXwmRkuMkte6KgM9tf:zrdMyIkfAXJsM9tf
TLSH D6A4234FAECA10C047DF0B397AE8EF64EE489B05165249324EB93DCED80DD986A4534F
Reporter abuse_ch
Tags:gz HSBC


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx621.qwords.net
Sending IP: 103.28.12.51
From: HSBC BANK <advising.service.26040270.825605.2830646254@securemail-advising.hsbc.com>
Subject: Payment Advice - Advice Ref:[GLVA30213309] / ACH credits / Customer Ref:[84668] / Second Party Ref:[55007020]
Attachment: Payment_Receipt_pdf.gz (contains "Payment_Receipt_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15b02389340ff546a4d0fc4c94b534b7e5e2711ded3992901043f6e6199694af/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 14:22:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwychcjub72unjgq7rgjjnjuw7s6e4i55u4zfeaqip3omgmwssxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz 15b02389340ff546a4d0fc4c94b534b7e5e2711ded3992901043f6e6199694af

(this sample)

Executable exe 4748d8754858143f280c1022b3c01ddc0a81e9fdf04babe1e711ef09d73124b6

  
Dropping
MD5 04732051fbd0344bcb41c30aaf9a9f7e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4748d8754858143f280c1022b3c01ddc0a81e9fdf04babe1e711ef09d73124b6

Comments