MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cef6976c4f45e3d2f0fc181f4efdf9850dd260bc89367ea2dbacad087ba34d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.Generic


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cef6976c4f45e3d2f0fc181f4efdf9850dd260bc89367ea2dbacad087ba34d3
SHA3-384 hash: bf52283d1f10ec19ab2c98debc82357ac4494e206f0401afb2ec12ef91b39feba3d3ffc397162f98872bf88ca47fcbc6
SHA1 hash: f8c06791ecd35bb386c8a290c5f12eb02dc68c0f
MD5 hash: 92c3d7e0f19c725646dc759eeb4c36e0
humanhash: south-eighteen-lamp-grey
File name:PROFORMA.ISO
Download: download sample
Signature Adware.Generic
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-19 06:36:51 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:Jx/MLiVFI8E2SO1l/oZzHACNIrl9F6G+WIEarFV:f1o8E2Scl4HMp9FzI9f
TLSH 8C457C92B8484868FD22377645775D3431AF6EE62636D74F239B37725FB31A2102BA03
Reporter cocaman
Tags:Adware.Generic iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Changchang Fang <almstr@ms21.hinet.net>" (likely spoofed)
Received: "from medeortz.co.tz (medeortz.co.tz [196.41.32.157]) "
Date: "Fri, 19 Feb 2021 08:44:37 +0300"
Subject: "Amended PI"
Attachment: "PROFORMA.ISO"

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cef6976c4f45e3d2f0fc181f4efdf9850dd260bc89367ea2dbacad087ba34d3/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-02-19 06:37:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ntxws5we6rpd2lypyga7j367tbin2jqlzcjwp2rnxlfnbb52gtjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6cef6976c4f45e3d2f0fc181f4efdf9850dd260bc89367ea2dbacad087ba34d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Adware.Generic

iso 6cef6976c4f45e3d2f0fc181f4efdf9850dd260bc89367ea2dbacad087ba34d3

(this sample)

Adware.Generic

Executable exe ad855c55e13ef5274a20805a3836b508c29cae12d0a2de2807aed08ed4090ddd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad855c55e13ef5274a20805a3836b508c29cae12d0a2de2807aed08ed4090ddd
  
Dropping
Adware.Generic

Comments