MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301
SHA3-384 hash: 64a92c574219eab86feeb8463494dffa913fbc9adc1979dbcd4cacf49a9a4d1f8798f396ca620db58a95fd670adc3c77
SHA1 hash: 7a797c81e2e34d72440dbe76d58541504ec176f5
MD5 hash: 44f943e20c73a71ef0dbca5a4a1957c4
humanhash: illinois-lactose-alabama-magazine
File name:QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj
Download: download sample
Signature NanoCore
Create hunting rule
File size:572'599 bytes
First seen:2021-03-31 06:59:32 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:k+bGf3Is1Aynx9NTZqx+Bgp3NfGUItIwLf//Buhi:FGf3B1N9Zi+q9fGNtRLf/Juhi
TLSH 78C423E42FF6D8631C1B7BD3A06067BE998D2939502C86177D3869F123D4ED3B50A1B2
Reporter abuse_ch
Tags:arj


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Chi Trinh <sales.chitrinh@trinityvietnam.vn>
Subject: REQUEST FOR QUOTATION
Attachment: QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj (contains "QUOTATIONs#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodRar-AIC.6001.15225.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 04:07:01 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7sxckasnvtzt45heeybxedm22gq7m3gp64afe64dfq2s4qcamaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

arj 5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301

(this sample)

NanoCore

Executable exe fcd1f447849497f6ee7e0d08f59f8220b457b6e9a0d02c227348ac313ba3196b

  
Dropping
MD5 5327c75e1b2988484ed78dd55e6ed630
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcd1f447849497f6ee7e0d08f59f8220b457b6e9a0d02c227348ac313ba3196b

Comments