MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35d4fe98ae0509221e65c50a5c9874c74641bd88bdd16fbe90cad4a3a0fe94b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35d4fe98ae0509221e65c50a5c9874c74641bd88bdd16fbe90cad4a3a0fe94b9
SHA3-384 hash: e537d00a18188bd9fe9b93a1d499be9337193086c416c4135400ef5642b026e01b16b0de97fc0e6192690c065520cd15
SHA1 hash: 18e5f84154f603992d295a51e85b9ccad3466ba1
MD5 hash: 65a80dfc2e730716faf0ba1b2e82928b
humanhash: april-seventeen-mobile-hot
File name:Cargo AIRLINES CSR.zip
Download: download sample
File size:64'781 bytes
First seen:2020-11-16 09:35:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:X7dBcgiwqv5TOFsidXeiIXYTtWaI1p44y4k3aTt5eO:XhRizv5a+eOi9Hyp44Nw5O
TLSH 205302B48865DBB8DB819376301DB7E6A7E4304E8FE63A9E78E44B12087D15434EE50B
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Ashish Jain" <office@nhaiderbd.com>" (likely spoofed)
Received: "from nhaiderbd.com (unknown [103.99.1.143]) "
Date: "16 Nov 2020 01:26:14 -0800"
Subject: "Cargo AIRLINES CSR 2ND FN Nov-2020"
Attachment: "Cargo AIRLINES CSR.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.19125.29454.15486.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35d4fe98ae0509221e65c50a5c9874c74641bd88bdd16fbe90cad4a3a0fe94b9/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 22:26:33 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gxkp5gfoauesehtfyuffzgduy5dedpmixxiw7puqzlkkhih6ss4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 35d4fe98ae0509221e65c50a5c9874c74641bd88bdd16fbe90cad4a3a0fe94b9

(this sample)

Executable exe c582dac0f0f94c07579c35ab71f62b25bf499123d3bea89a33a6b8a80ee3325c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c582dac0f0f94c07579c35ab71f62b25bf499123d3bea89a33a6b8a80ee3325c

Comments