MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a2998327c65c07148f057e65326099b17a27159243bc8851e8aef90d12ec860. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a2998327c65c07148f057e65326099b17a27159243bc8851e8aef90d12ec860
SHA3-384 hash: aa5115b93ba815e2b53607f35e4a35e14b630953678ae6b18245c4b985e54bb50e43292f618c3de12924c8c05b422fd5
SHA1 hash: 77f702f87bd31ab32b9d4f8c9dbf41cbad292990
MD5 hash: 426be796aa1c0419ffe1414f4776cfcc
humanhash: idaho-video-south-romeo
File name:PO.z
Download: download sample
File size:1'477'772 bytes
First seen:2020-05-05 09:52:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:rq2aIN4hpyaZB2rJ/zljy7ilRUHxB+sAmtupmk9bo3cIePuicya:/a/ytJbljBleRB+sAIukS0cyi/a
TLSH B5653391FC97ADB4C2D953F00B2F31A4F491AD071CE99E3A0AB3E46694D73A21E15C63
Reporter abuse_ch
Tags:geo THA z


Avatar
abuse_ch
Malspam distributing :

HELO: mono.avnam.net
Sending IP: 190.210.186.210
From: SON DAR ELECTRONIC TECHNOLOGY CO., LTD. <sales@sondar.com.tw>
Reply-To: sales@sondar.com.tw
Subject: ใบแจ้ง\x0aหนี้ / PO-909000
Attachment: PO.z (contains "PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaB.29734.124.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:08:19 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jiuzqmt4mxahcshqk7tfgjqjtml2e4kzeq54rbi6rlxzbujozbqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 4a2998327c65c07148f057e65326099b17a27159243bc8851e8aef90d12ec860

(this sample)

Executable exe f937bbe27c6d52452a121bc9aa320c26ae7eada7cadc9dda0fafc2c6b1bd5818

  
Dropping
MD5 f512638b09983b315c24199bffae80cc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f937bbe27c6d52452a121bc9aa320c26ae7eada7cadc9dda0fafc2c6b1bd5818

Comments