MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20da7f1d4b37522712e9e132f6534e585afc19a8493c0b55609742f6183e38fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	20da7f1d4b37522712e9e132f6534e585afc19a8493c0b55609742f6183e38fb
SHA3-384 hash:	3859ddb94016c9cb1c453f0350972453aa259b2fe836390876117ed12282b154362e0fe220696a29e2b18d0d29e65108
SHA1 hash:	d33d043dfba8fae7831102bd0a96e03ae9b4120b
MD5 hash:	34df9ad0c07b4fe4fa51c6567eb1cbc0
humanhash:	monkey-nine-eighteen-oranges
File name:	5625862605.zip
Download:	download sample
Signature	Casbaneiro Alert Create hunting rule
File size:	11'251'851 bytes
First seen:	2022-12-19 18:29:50 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:WTm1hJRyISPbjdz3YhnAxfKKfqrLJrx6Drm2zNspfDEa9KzCr:WUjUISPbjV3YhnwXqrLFx6DrFNsZDQzE
TLSH	T179B6332E79C9D909F736F631FF2E49218CA4A2E3D60D9E56E22FAE9C5F077790015420
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	johnk3r
Tags:	banker BR casbaneiro file-pumped geofence zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

174

Origin country :

BR

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	29192712-“.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	321'308'748 bytes
SHA256 hash:	d828acf6bcee5a324e0420cf3505d76d5df733498b320c36cf8d66620b6fabfd
MD5 hash:	16952b5290b6241d628d2601ae985f76
De-pumped file size:	13'026'816 bytes (Vs. original size of 321'308'748 bytes)
De-pumped SHA256 hash:	70448e6273de253ea94e84f221a9c0cc071f9a2008fb9f1ccd08a23d552c7388
De-pumped MD5 hash:	d2ee87a44f0ffefb98de1fdd226e3b05
MIME type:	application/x-dosexec
Signature	Casbaneiro

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware keylogger large-file overlay packed

Link:

https://www.filescan.io/uploads/63a0adad329e69a36441c5d0/reports/ac73e56f-7cc9-4a38-9392-e4303ed81b52/overview

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20da7f1d4b37522712e9e132f6534e585afc19a8493c0b55609742f6183e38fb/

ReversingLabs TitaniumCloud Binary.Trojan.Generic

Threat name:

Binary.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2022-12-19 18:30:47 UTC

File Type:

Binary (Archive)

Extracted files:

76

AV detection:

5 of 39 (12.82%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ednh6hklg5jcoexj4ezpmu2olbnpygnije6awvlas5bpmgb6hd5q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/221219-xn8fkaah3w/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/20da7f1d4b37522712e9e132f6534e585afc19a8493c0b55609742f6183e38fb

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Padawan commented on 2022-12-19 18:42:50 UTC

https://workspacesondrives.smallpdfonlinespaces.]com/08903d7b2045fc798ed147ee827530a42d1decc2