MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f9fb483bef8695dfb06427543139337013f48ddaddcbbd13c0b53686d4cbd06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f9fb483bef8695dfb06427543139337013f48ddaddcbbd13c0b53686d4cbd06
SHA3-384 hash: 09bea28d680931d79299fd7d7669a0df8a6f0dbd1c97465d3e9dae6d514b4d055120f97a1958865a0637425ba9dbfc23
SHA1 hash: ab6fe0a853d8a7f3c9135df5ce22608cbfb23127
MD5 hash: 122e1b66a04dd88bf987fe1026922490
humanhash: maryland-emma-pizza-music
File name:INVOICE_47383.iso
Download: download sample
File size:83'968 bytes
First seen:2021-02-20 09:33:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 384:K26Rtehpab6Hbep3x6YlTKu2ieewQGi/o/BbG/vh:KBrehpzH6eYlTv2JQGigZSXh
TLSH CC83E804F7A41A13E439797920A23A48D3B3B6D266F5E6373F4C64E59B43BD32A1C309
Reporter cocaman
Tags:iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Chanboramey Kong <jzhang1@aldogroup.com>" (likely spoofed)
Received: "from aldogroup.com (unknown [185.239.242.64]) "
Date: "20 Feb 2021 08:48:36 +0100"
Subject: "Re: RE: MAERSK FCR WMT ETD 11-OCT-2020 WHA SUN"
Attachment: "INVOICE_47383.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f9fb483bef8695dfb06427543139337013f48ddaddcbbd13c0b53686d4cbd06/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-20 06:36:19 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
6 of 48 (12.50%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6p3ja567buv36ygij2uge4tg4at6sg5vxolxuj4bnjwq3kmxuda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

iso 5f9fb483bef8695dfb06427543139337013f48ddaddcbbd13c0b53686d4cbd06

(this sample)

Executable exe badf31d977ae00d0c4886883d2b9722ae7250939bc5d75566d9ffd0dd59fd171

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 badf31d977ae00d0c4886883d2b9722ae7250939bc5d75566d9ffd0dd59fd171

Comments