MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 688d89890b3655d8b2810d5c9d9684b664344e91c9e57c04dfc502e150b5c234. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 688d89890b3655d8b2810d5c9d9684b664344e91c9e57c04dfc502e150b5c234
SHA3-384 hash: 5343fae92f6e0ba7fae29496b144d0adab69f377e7ec95e4725668b058e0b47e37148903a41f4a69a8cccac47b1252ea
SHA1 hash: 4f064cc2b9bea7d77dceb4b390727b1ea10ca1e0
MD5 hash: 858dccc3d7cb1cdbf5e7c0ade8c9bd98
humanhash: golf-hawaii-tennessee-vegan
File name:Tracking No_pdf.gz
Download: download sample
File size:539'013 bytes
First seen:2020-10-07 05:03:08 UTC
Last seen:2020-10-07 05:04:17 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:5i74+FW4NmuT/no9FcjCIymvk8DxPljn+bO5yyC:Q7LFSuT/nouCIymM8VlYQTC
TLSH ABB423B0E706C60ACBAB4D79732147FA7850754F916D019EF31C230B2552A8BEADF46E
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: Kravag.de
Sending IP: 45.137.22.75
From: Pia.Baier@Kravag.de
Subject: WG: CIV2020-10 Shipping Documents
Attachment: Tracking No_pdf.gz (contains "Tracking No_pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/688d89890b3655d8b2810d5c9d9684b664344e91c9e57c04dfc502e150b5c234/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 02:08:24 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncgytcilgzk5rmubbvoj3fuewzsditurzhsxybg7yubocufvyi2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/688d89890b3655d8b2810d5c9d9684b664344e91c9e57c04dfc502e150b5c234

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz 688d89890b3655d8b2810d5c9d9684b664344e91c9e57c04dfc502e150b5c234

(this sample)

Executable exe 5f7c84c5a62c4603069eada6e50059cc6e2a6cf7ab8be1281e04a7501667a074

  
Dropping
MD5 4fd32c6e50a8d58c5502a8176a1037e7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f7c84c5a62c4603069eada6e50059cc6e2a6cf7ab8be1281e04a7501667a074

Comments