MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bb56dec6e54999f36d8d4af3322c985090b2ab578b4a9ccd420ee18b4869698. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bb56dec6e54999f36d8d4af3322c985090b2ab578b4a9ccd420ee18b4869698
SHA3-384 hash: 04862344049bd34157a7ed1c202c401204c10625890c9b32a3992a0e162b6bc5e26d9736fda353f921ee2547e797800f
SHA1 hash: 0b2cce50650e8531f0f0315e4ab25fa2d098237c
MD5 hash: 3f73e96792ee65277b97f04e706d90a5
humanhash: india-six-don-emma
File name:PO-098000.7Z
Download: download sample
File size:812'548 bytes
First seen:2020-08-14 10:58:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lUA2EY9ycCr7bKzjU9yUNTrAzl/N4SqyApTKLlguz9COBkXT3K46F/DRe1eavwIf:2EY9yN7u0qN15+uz9LBkXTV6J45P
TLSH 9E05237C14C9780DD34356E2484A4F631E6FE0A698A933467BE0FC3B1FE28673A255E5
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: wanriton.com
Sending IP: 45.137.22.52
From: Roy@wanriton.com
Subject: PO-098000
Attachment: PO-098000.7Z (contains "PO-098000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader34.22910.20294.6655.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bb56dec6e54999f36d8d4af3322c985090b2ab578b4a9ccd420ee18b4869698/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-14 10:59:09 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=no2w33doksmz6nwy2sxtgiwjqueqwkvvpc2kttguedxbrnegs2ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6bb56dec6e54999f36d8d4af3322c985090b2ab578b4a9ccd420ee18b4869698

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 6bb56dec6e54999f36d8d4af3322c985090b2ab578b4a9ccd420ee18b4869698

(this sample)

Executable exe 706c3e2ae6ed72040ab9b9c9d7918a24368288480d487e86fcc1731114656e78

  
Dropping
MD5 379d5341f78204ef45d48eeb2ded87c8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 706c3e2ae6ed72040ab9b9c9d7918a24368288480d487e86fcc1731114656e78

Comments