MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4735bad92b94d7a21ce506fa7605d43398573e4904c4623788abc95aa5f6f31b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4735bad92b94d7a21ce506fa7605d43398573e4904c4623788abc95aa5f6f31b
SHA3-384 hash: 66f3fa1b9313de1206d865995d8f003e91b41388e037911f2705137adcabcb2b202a6a67186825cda67d1cfe64bff6ac
SHA1 hash: 36ab57d807e57e271ba77d12e28744e1ed2cc0fc
MD5 hash: c559c382b8595331d6917ed485059cce
humanhash: tennessee-monkey-crazy-asparagus
File name:6020154744.rar
Download: download sample
File size:464'602 bytes
First seen:2021-01-26 06:35:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:aZJD2Fl+cQoUt/2B/d3NwNI+f12FlWb6w6FRu2o:aZJDQ3UtmNNwGQ12Fl01GY
TLSH 2AA423CC5BDF890BD296A38D8A9C261C78373D2B8D145033119DD774BEA13B46ABE247
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Dina Hossam <dina.hossam@dhl.com>" (likely spoofed)
Received: "from box.dertysm.xyz (box.dertysm.xyz [134.122.14.245]) "
Date: "Mon, 25 Jan 2021 17:07:25 -0600"
Subject: "AWB Copy ,6020154744"
Attachment: "6020154744.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.1757.11104.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4735bad92b94d7a21ce506fa7605d43398573e4904c4623788abc95aa5f6f31b/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-26 06:36:12 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i423vwjlstl2ehhfa35hmbougomfopsjatcgen4ivpevvjpw6mnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4735bad92b94d7a21ce506fa7605d43398573e4904c4623788abc95aa5f6f31b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 4735bad92b94d7a21ce506fa7605d43398573e4904c4623788abc95aa5f6f31b

(this sample)

Executable exe 77d54c4049d7d7beca2c7f4897882ca793587b22def49d1b2268f6707a17285a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77d54c4049d7d7beca2c7f4897882ca793587b22def49d1b2268f6707a17285a

Comments