MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7392dc8ab3209c5b035a9a8ae0846c77592e9945737057c8d0ee792336f9f976. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7392dc8ab3209c5b035a9a8ae0846c77592e9945737057c8d0ee792336f9f976
SHA3-384 hash: 04157898852512a8e3a35776e3c7059b91dbb26d95c80146d1a5adf2571bba941a1c285c811f59a49cc420e56435132d
SHA1 hash: c8fb4f1e729cc867f2d646376c8c712cc27d2fda
MD5 hash: 04c36e63e563b4454c2e0d99611acd2a
humanhash: twenty-early-earth-ceiling
File name:Scan432.zip
Download: download sample
File size:815'561 bytes
First seen:2020-05-12 16:31:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Mu3MXoDPc5gmt97c8sRHR6oprjPV0WWlP0SW:RbyXDsRHR6opfNNAPrW
TLSH 840533BF34C0ABCC69CC918D404A6D1B564A9C58FFB3CC0ABB464129916BC7FC51F96A
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.linux55.papaki.gr
Sending IP: 136.243.171.45
From: Sales <Lanlijun@gsk.com.cn>
Subject: Ammended order
Attachment: Scan432.zip (contains "Scan432.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 13:02:33 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oojnzcvtecofwa22tkfobbdmo5ms5gkfonyfpsgq5z4sgnxz7f3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 7392dc8ab3209c5b035a9a8ae0846c77592e9945737057c8d0ee792336f9f976

(this sample)

Executable exe 1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298

  
Dropping
MD5 3d260edb40b86806fd043e370369b6f5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1edf8c6bcf0ae2b38e9e28bcb1fd838c2ea35b5b126e4bc9e42daa2e1e722298

Comments