MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 614b1804f29b1fd1aaaf62dd34c9a731bd43d68f47407e0ca2aec09a246e4101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 614b1804f29b1fd1aaaf62dd34c9a731bd43d68f47407e0ca2aec09a246e4101
SHA3-384 hash: 6df5129cf8594eff9c54ecfdd9136bfadbb3816252498619e35e7d5980230085f6971aea9dcbd31d9a18d52b2ef2a60a
SHA1 hash: 9a27a8aec0162402b57b8fb4cafbd73865bb006f
MD5 hash: 78e809c55f5df7c849de4218d153ad21
humanhash: monkey-speaker-spring-helium
File name:image.zip
Download: download sample
File size:342'739 bytes
First seen:2020-08-14 08:53:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:88+GDTfJCgH1G4GrA9jqHf/VCSG3hwzlMpkouhQMSwy+lqSHTonaDyvSdqNX:9a46A9jq//4hWRWMSw8SknnqK
TLSH E27423AC4649171EACCD6CB886A3F556039487F7620969104ECFB3FFC004E56B66F91B
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp124.iad3a.emailsrvr.com
Sending IP: 173.203.187.124
From: ASB Bank <no-reply@asb.co.nz>
Subject: Payments for a law firm.
Attachment: image.zip (contains "image.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21078.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/614b1804f29b1fd1aaaf62dd34c9a731bd43d68f47407e0ca2aec09a246e4101/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:55:08 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mffrqbhstmp5dkvpmlotjsnhgg6uhvupi5ah4dfcv3ajujdoieaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/614b1804f29b1fd1aaaf62dd34c9a731bd43d68f47407e0ca2aec09a246e4101

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 614b1804f29b1fd1aaaf62dd34c9a731bd43d68f47407e0ca2aec09a246e4101

(this sample)

Executable exe 25f0420d3551985569fb57497301c7d2f691083d7318d28db5bab2e8a6a0bb85

  
Dropping
MD5 8386b787dfff37c3e7bcdcc03a0a7487
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 25f0420d3551985569fb57497301c7d2f691083d7318d28db5bab2e8a6a0bb85

Comments