MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cae46412d02b950b6e0a3b4f591d61798520bf7a0396ece8db336bd3aefa409. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cae46412d02b950b6e0a3b4f591d61798520bf7a0396ece8db336bd3aefa409
SHA3-384 hash: 8f8b1cc992e6457d95efd16ac9b184e204e7bc0677d2e805e5926094ba96d5528281aea9a6777b05f8c2191fe4aa9166
SHA1 hash: 1a0c441c4193a2a28cacee9614e5e4f2d26cb38a
MD5 hash: fb28964ad92e318fd38ff5bca183d9a1
humanhash: alaska-two-avocado-sodium
File name:09009000INVOICE.zip
Download: download sample
Signature Matiex
Create hunting rule
File size:596'244 bytes
First seen:2020-12-08 07:51:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:2XDW+UcDz5wogLpbYZ6EL5DzAHsDX/TjQy0Q94A9VqQfqg6:YDfUMLg1YQEL53s2X/YeH+Qfl6
TLSH 81C423E17E606915947E6777B6182446F30B0CA824A28FFFCD051AA27E6C8DFC9F15C2
Reporter abuse_ch
Tags:geo VNM zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.58.152
From: sales@martinmachinery.com
Reply-To: abdaiian.harrouni@gmail.com
Subject: HÓA ĐƠN THANH TOÁN-065770
Attachment: 09009000INVOICE.zip (contains "09009000INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Win.Trojan.Autoit-7356348-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cae46412d02b950b6e0a3b4f591d61798520bf7a0396ece8db336bd3aefa409/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 07:52:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nsxemqjnak4vbnxauo2pleowc6mfec7xua4w5tunwm3l2oxpuqeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cae46412d02b950b6e0a3b4f591d61798520bf7a0396ece8db336bd3aefa409

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip 6cae46412d02b950b6e0a3b4f591d61798520bf7a0396ece8db336bd3aefa409

(this sample)

Matiex

Executable exe 32a0c4d5fea8fbc8dd04dbf43f3d3877184651e1b59fd831bdd2af1a64e8f7aa

  
Dropping
MD5 36d3443b39511f4f06e5227cd64b1834
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32a0c4d5fea8fbc8dd04dbf43f3d3877184651e1b59fd831bdd2af1a64e8f7aa

Comments