MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 867130e1d4af126ebee45e5b52bb4679233a3aa1678d1411b34373b9bccabeec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 867130e1d4af126ebee45e5b52bb4679233a3aa1678d1411b34373b9bccabeec
SHA3-384 hash: fc776d27c0c08b6908e9e8f46f2e53228eb0ff7120b869e174669568be5ff9af9c8f010c87c4a8d88cc2fb27cb2ba2c5
SHA1 hash: 05cec396e8c367ca953dcf5d522bdee6f69776ea
MD5 hash: 0cbd41379cf4ff250190ffbcf68b8367
humanhash: carolina-michigan-july-california
File name:Scan34295420.img
Download: download sample
File size:1'441'792 bytes
First seen:2021-01-13 20:10:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:mUpoZgRa4fL8YPFhkENO4jfCbN89CzZWcprk2N+tKypNGetg2e/09H:m2oZgVfL8CzDNj6uIWSA7pm2
TLSH 48659282F355CE80F66431BB979EA62A1342FCCF0B03CA95631A7E751E7B1C12D8D658
Reporter abuse_ch
Tags:img MailChannels


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: bumble.maple.relay.mailchannels.net
Sending IP: 23.83.214.25
From: Accounts <Accounts001@psg.com>
Reply-To: Account <psg@safrica.com>
Subject: Pay001 January
Attachment: Scan34295420.img (contains "Scan34295420.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.505.1657.31896.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/867130e1d4af126ebee45e5b52bb4679233a3aa1678d1411b34373b9bccabeec/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:11:07 UTC
AV detection:
7 of 44 (15.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qzytbyouv4jg5pxelznvfo2gpertuovbm6grientinz3tpgkx3wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/867130e1d4af126ebee45e5b52bb4679233a3aa1678d1411b34373b9bccabeec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img 867130e1d4af126ebee45e5b52bb4679233a3aa1678d1411b34373b9bccabeec

(this sample)

Executable exe 75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

  
Dropping
MD5 389ca41e54649946a7b8b1c15d0da2df
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

Comments