MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c776a5373d0ef3f69ce8c73a4a3e1175b1cc492eadebd03dd05efef35c4f093. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Citadel


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c776a5373d0ef3f69ce8c73a4a3e1175b1cc492eadebd03dd05efef35c4f093
SHA3-384 hash: f53703c1329fcd7dd9541dc6ba89c45928c070a02f9b4ccbf5748e12720b05becd4c27d1fb32709eb6c8c3756aa1c437
SHA1 hash: b3ac7414333f5c303cb8b3189807a8935756812b
MD5 hash: 68f02e714aee5ef4a7d59edd0b8fce4a
humanhash: kilo-oven-nine-florida
File name:VGM + ISF + invoice+packing list.zip
Download: download sample
Signature Citadel
Create hunting rule
File size:634'052 bytes
First seen:2021-01-12 07:23:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:vmCNuo8B0xE8DjD1HxrFT6F1D7bzEbBkmi7BcOixjzd:vbD8GEsjD5H81DPAbBkx7Bc5fd
TLSH 5ED423E83910D6AA9F4674F3CD12D6E25A0532A373D9B975290CDA15960AFA083CC7F3
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.jetmails.xyz
Sending IP: 5.189.220.165
From: "Jennifer Chen <Jennifer.Chen@chrobinson.com>" <admin@jetmails.xyz>
Subject: S/O# 0822 cut off; 01/18 <AMEND> s/o# N085 Cut off:01/22 聯船期詢問
Attachment: VGM + ISF + invoice+packing list.zip (contains "VGM + ISF + invoice+packing list.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4c776a5373d0ef3f69ce8c73a4a3e1175b1cc492eadebd03dd05efef35c4f093/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 00:23:25 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jr3wuu3t2dxt62oorrz2ji7bc5nrzres5lpl2a65axx66noe6cjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.88
Link:
https://yomi.yoroi.company/submissions/4c776a5373d0ef3f69ce8c73a4a3e1175b1cc492eadebd03dd05efef35c4f093

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Citadel

zip 4c776a5373d0ef3f69ce8c73a4a3e1175b1cc492eadebd03dd05efef35c4f093

(this sample)

Citadel

Executable exe bebdaba9f180c6a34000e35386d3c7a7d31e280089b797adf6df0ca5a770be8f

  
Dropping
MD5 4c4a0f6eaa5cd3ba365fa8fceb3f17c6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bebdaba9f180c6a34000e35386d3c7a7d31e280089b797adf6df0ca5a770be8f

Comments