MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61dab612756cb9681e6179463dc7a19ec32919e1973f0d5e20eeecdb858ed68c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61dab612756cb9681e6179463dc7a19ec32919e1973f0d5e20eeecdb858ed68c
SHA3-384 hash: 5ce258746aa8cb8059369ac2e7923200d8923676821e8991aee85d46668013985309f595f5fc90172562d0090de472a3
SHA1 hash: f25fd9fadcc9034d68ba082c66306ea18b568dd0
MD5 hash: f476bb0f2f6e2820cd6bc54150dbb4af
humanhash: sweet-maryland-utah-oscar
File name:DB0127718.7z
Download: download sample
File size:280'024 bytes
First seen:2021-01-19 16:40:17 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 6144:0pGlVWO6RIL2rdn3JFJMOMJI93Ot8+IN0v3s5UbG:08/WO6m2JZFJMDwiWa/s5UbG
TLSH 9F5423CDBD73CCD4F10C7615006A6827FD9657A5A2AE8C0DBE6FAFA475E0054810CA9E
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email (T1566.001)
From: ""Monica"<admin@zalletpack.ml>" (likely spoofed)
Received: "from 416905-cn72172.tmweb.ru (416905-cn72172.tmweb.ru [188.225.47.160]) "
Date: "19 Jan 2021 17:19:19 +0100"
Subject: "New Order DB0127718 from D B Cash & Carry"
Attachment: "DB0127718.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Neshuta-1
Create hunting rule

PUA.Win.Packer.Pequake-4
Create hunting rule

Win.Virus.Neshta-7101689-0
Create hunting rule

Win.Trojan.Jadtre-5
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61dab612756cb9681e6179463dc7a19ec32919e1973f0d5e20eeecdb858ed68c/
Threat name:
Win32.Virus.Neshta
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 16:41:06 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mhnlmetvns4wqhtbpfdd3r5bt3bssgpbs47q2xra53wnxbmo22ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Neshta
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61dab612756cb9681e6179463dc7a19ec32919e1973f0d5e20eeecdb858ed68c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

7z 61dab612756cb9681e6179463dc7a19ec32919e1973f0d5e20eeecdb858ed68c

(this sample)

Executable exe 2afdd3aa2feb767d46e6da9b81c1d77dc1592df952980b5ee636a97ecd3f8e62

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2afdd3aa2feb767d46e6da9b81c1d77dc1592df952980b5ee636a97ecd3f8e62

Comments