MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b7892f8cac004d3f31605c0d9369936e1bcf33d80cd93005e72c89ec6e2b4a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b7892f8cac004d3f31605c0d9369936e1bcf33d80cd93005e72c89ec6e2b4a3
SHA3-384 hash: d635b7c9e713ad3c570ea6de14a9e1170e086310525fe4de58db93165c51824e845371c956ffc3a09a5669e94fca5c6a
SHA1 hash: 96826cad84ea0702f78d127489f213cd56e7c42f
MD5 hash: 5cc8e19ce4f3069bdd0a98bc4b197d39
humanhash: purple-hydrogen-fourteen-floor
File name:New Order.LHA
Download: download sample
File size:344'032 bytes
First seen:2020-11-09 15:53:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:H1Obhpdn25335dgu4Sbn4ag4NEXyFxdTP/5C8w6yGcEu3tf6Jsgf6ppW/mVh4fj:VGr2pzgLSwXyDdDI8wfGcEu3tSJnIk/H
TLSH 0C742336038AE90A7C65C919C65E4264FCF9D2A013D94D5AF7E1F6119BD2C0393CCAAF
Reporter abuse_ch
Tags:lha


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hvx2062.celeo.net
Sending IP: 194.165.49.62
From: Nadia Murashkovskaia (BBDO Russia) <nadia.murashkovskaiabbdo@mail.ru>
Subject: QUOTE USD PRICED FOR ATTACHED
Attachment: New Order.LHA (contains "New Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b7892f8cac004d3f31605c0d9369936e1bcf33d80cd93005e72c89ec6e2b4a3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 10:24:20 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pn4jf6gkyacnh4ywaxansnuzg3q3z4z5qdgzgac6olej5rxcwsrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Renos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b7892f8cac004d3f31605c0d9369936e1bcf33d80cd93005e72c89ec6e2b4a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 7b7892f8cac004d3f31605c0d9369936e1bcf33d80cd93005e72c89ec6e2b4a3

(this sample)

Executable exe 518628a52655227136f54842d662c8dfea11f017ac7ef02fd1d87080bbcbc831

  
Dropping
MD5 07b7bc1f0718aea00a757b4eefe7ee34
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 518628a52655227136f54842d662c8dfea11f017ac7ef02fd1d87080bbcbc831

Comments