MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f91d452fae2524ffececd40eab523f41dc37d2a72f5ad03b47ea84bedd79a31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f91d452fae2524ffececd40eab523f41dc37d2a72f5ad03b47ea84bedd79a31
SHA3-384 hash: 80a3dcdc1bf9e0919fa7d6bb26f3a24b8e759314d84328901a3767d53f677f3fae01f283bc8bd06c94bde82c2d901dd8
SHA1 hash: 227f077dc72037911fa7f2f9fb8b379a384ecf9a
MD5 hash: e94ad9f78827d67cc6f6a9abecd22a50
humanhash: louisiana-double-nuts-red
File name:P.O 000000893302.zip
Download: download sample
File size:957'188 bytes
First seen:2020-10-22 07:48:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zl7jI2CN03NBurITby0KWvsof6qXTF+8CM2oUfVAjmMZinSiUwn76VN4+2Fkgkmt:hIEnu0t7PX88iZMZ4Uw764+2pkm+esu
TLSH C81523178E9E3B7AC91DD00D52FAC20978E23BF4EA853F2521855DBD2796F240C3B15A
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp77.ord1c.emailsrvr.com
Sending IP: 108.166.43.77
From: Chen Yuting <chenyuting@arico.com.tw>
Subject: Purchase order 000000893302 10/22/2020
Attachment: P.O 000000893302.zip (contains "P.O 000000893302.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AutoIT-3.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f91d452fae2524ffececd40eab523f41dc37d2a72f5ad03b47ea84bedd79a31/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 03:35:25 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6i5iux24jje77wozvaovnjd6qo4g7jkol222a5up2uex3oxtiyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 6f91d452fae2524ffececd40eab523f41dc37d2a72f5ad03b47ea84bedd79a31

(this sample)

Executable exe 9954c894d8d064be1d08da2ed944c7880c7b3ba02cc7b6902f6f128168f6baa5

  
Dropping
MD5 c35f8cc7ffd7deec4309fa4876eed36b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9954c894d8d064be1d08da2ed944c7880c7b3ba02cc7b6902f6f128168f6baa5

Comments