MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vjw0rm


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614
SHA3-384 hash: f93e561fcf99bb516a2e53fdb46469dc89aa8846da55209567268924be5d858c487d44498361905dac68938d9bd13acb
SHA1 hash: 5db3b86166730fa4f0eaa619c1c533710bc2256a
MD5 hash: 8aa7859f1d6f56bb1d077b28134f5e06
humanhash: lactose-single-utah-grey
File name:invoice.vhd
Download: download sample
Signature Vjw0rm
Create hunting rule
File size:18'919'424 bytes
First seen:2023-05-02 14:25:12 UTC
Last seen:Never
File type:
MIME type:application/octet-stream
ssdeep 24576:wS5Sjh/M4YK6dJ5oA8F2nFnHb6T8Ujl6vO01C1GCTsYoQZtlsZdc40QDrUYuGG1p:B0jVBkBHdTUwTGTTOWjBiO8pG+C3
TLSH T194178D34B3F04FA2D1A9063B9AE1962956FC6E48DF76C38BD160388564F2FC16E4125F
Reporter notajungman
Tags:vhd vjw0rm zgRAT


Avatar
notajungman
inside password protected zip - pw 123

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.Guinnesses.20220719.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.UnicodeSEOUL.20230417.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/64511d7b1facab193c6714e6/reports/b4a8ffb1-196a-446b-9c4d-a9eec4d160a7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-01 18:11:37 UTC
File Type:
Binary (Archive)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ok5exut4lwkzckwf4vzijhykv5lmlbz6ap2vs3fyfzlkzb46gyka._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230502-ry5vjabd44/
Behaviour
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Vjw0rm

72ba4bd27c5d95912ac5e572849f0aaf56c5873e03f5596cb82e56ac879e3614

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments