MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6299b0c37eb219b58926550fa991f45e719b167e945166ae0d25eaf3a8afd54d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6299b0c37eb219b58926550fa991f45e719b167e945166ae0d25eaf3a8afd54d
SHA3-384 hash: 4062b5f0c50e634f0093ba21736dbb0798f66f8a46252f879fcf33adb59c4dbea496bcf2b056f9181e5cefd2c5e0bf07
SHA1 hash: 7dcd608c598f1b4d88e15d88246e0c6fad6ddbee
MD5 hash: 276d5fbefa8bdca187efcef07a8287ed
humanhash: uranus-island-mobile-pennsylvania
File name:Payment.zip
Download: download sample
Signature Matiex
Create hunting rule
File size:702'502 bytes
First seen:2020-10-12 05:50:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6u5ojnw/BFjaUORvqw4fF7oIX9TvWZwJXIWyuUhcGoHE8:SkZr0zGNpX9c8XlyQGkE8
TLSH 1EE423FAFED063D553FA6E3D1E6809181519D71EE0384CB5D9B292E3816EF078E302A5
Reporter abuse_ch
Tags:geo ITA Matiex zip


Avatar
abuse_ch
Malspam distributing Matiex:

HELO: dd35620.kasserver.com
Sending IP: 85.13.152.153
From: Banca Credito Italiano - Unicredit Group <info@maler-fuhrmann-schmidt.de>
Reply-To: snambrath.almandoos@bk.ru
Subject: Re: Payments - October Invoices
Attachment: Payment.zip (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6299b0c37eb219b58926550fa991f45e719b167e945166ae0d25eaf3a8afd54d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:16:32 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkm3bq36wim3lcjgkuh2tepulzyzwft6sriwnlqnexvphkfp2vgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/6299b0c37eb219b58926550fa991f45e719b167e945166ae0d25eaf3a8afd54d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 6299b0c37eb219b58926550fa991f45e719b167e945166ae0d25eaf3a8afd54d

(this sample)

Matiex

Executable exe 0884545d40e89c0a2620358d5092c1344c09a8fab771bdd471245aff9d9c06b3

  
Dropping
MD5 26eb32ee68458265650199296c4c83f9
  
Dropping
Matiex
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0884545d40e89c0a2620358d5092c1344c09a8fab771bdd471245aff9d9c06b3

Comments