MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a39a8d1bd7ace06dfed1f7e41869dec9613ffffcf21d4e34a48766fbbe1ad3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a39a8d1bd7ace06dfed1f7e41869dec9613ffffcf21d4e34a48766fbbe1ad3f
SHA3-384 hash: 0c8bb601d619794b6bd2fcdfb5ab1c952f85e363b4556efebe6cd8264ab23c65106306adc7af52b8a069ee69a0669ef0
SHA1 hash: 3feba3c111727cec29953f99eeb89ff74d3cb574
MD5 hash: 9c1d9b32b64872bbc592db26554c6edd
humanhash: charlie-uncle-helium-stairway
File name:QUOTE.zip
Download: download sample
File size:728'145 bytes
First seen:2020-11-05 10:01:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ufcCaQ7xATEEYChwp1CtXDcEyB5g4ath94pXTVLdNXkSbK3r:ufcFQ7xATEEYPp8IlC4atbUzhbw
TLSH B5F4235CE8919F96D6EF64336D6B08913CD1BE66B30E92FEF9AA710D04C30A550EC5C2
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: v133-130-74-17.myvps.jp
Sending IP: 133.130.74.17
From: Indofa <iumcsby@indofa.com>
Reply-To: Lui@indofa.com, mark@indofa.com
Subject: Request for quotation
Attachment: QUOTE.zip (contains "QUOTE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42665.13024.19437.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a39a8d1bd7ace06dfed1f7e41869dec9613ffffcf21d4e34a48766fbbe1ad3f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 20:06:32 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ni42run5plhanx7nd57edbu55slbh777z4q5jy2kjb3g7o7bvu7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 6a39a8d1bd7ace06dfed1f7e41869dec9613ffffcf21d4e34a48766fbbe1ad3f

(this sample)

Executable exe fa4b68c46fd7d4f0d304d9ae66988a45ce8fba53a600ec2b29e9d0ad89517f23

  
Dropping
MD5 d86b5e349bf57912cf2dfd0b64b770e5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa4b68c46fd7d4f0d304d9ae66988a45ce8fba53a600ec2b29e9d0ad89517f23

Comments