MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5760f8e07801033ec690d78c481f9b036b847f286c9696942472eca1a863daf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5760f8e07801033ec690d78c481f9b036b847f286c9696942472eca1a863daf5
SHA3-384 hash: 83d49eb72ec2e1c55dae9b8456045d56784caadbe54f4cbefc09916f06bf84874e67a5c7a40635281b50e88433e6e976
SHA1 hash: c536d1fef42678567a63e918c40a38b6fc494996
MD5 hash: c3e4c3e9fc28e4e8b7710715d7eb1d07
humanhash: johnny-seven-equal-zulu
File name:Quotation 30 CS fittings.r00
Download: download sample
File size:646'574 bytes
First seen:2020-12-09 10:44:43 UTC
Last seen:2020-12-09 14:30:37 UTC
File type: r00
MIME type:application/x-rar
ssdeep 12288:RNmrUcSf6gyPRRjDgL5RuhYr/IBGSnIE8UND54eq+uqedvLTotmJKoVY:/mr1HRolRuhufGd8Ui+uqedv/otiY
TLSH 72D433023B91C0B2E8323E44A66176D8E69FD79B5F8E46FC228D990BDE84D05F2CD15D
Reporter abuse_ch
Tags:r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: omanht.com
Sending IP: 185.222.57.177
From: Mujtaba Hassan <sales@omanht.com>
Subject: Quotation #30 (CS fittings)
Attachment: Quotation 30 CS fittings.r00 (contains "Quotation #30 (CS fittings).exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201210-0803.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5760f8e07801033ec690d78c481f9b036b847f286c9696942472eca1a863daf5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 10:45:12 UTC
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5qprydyaebt5ruq26geqh43anvyi7zinsljnfbeolwkdkdd3l2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5760f8e07801033ec690d78c481f9b036b847f286c9696942472eca1a863daf5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

r00 5760f8e07801033ec690d78c481f9b036b847f286c9696942472eca1a863daf5

(this sample)

Executable exe a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8

  
Dropping
MD5 a095b722591343954b0318054c4be1d7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8

Comments