MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 874f08f05b9ee2fd92c514a5b2be371a012dcc4d791d3406187968f5b0eb4288. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 874f08f05b9ee2fd92c514a5b2be371a012dcc4d791d3406187968f5b0eb4288
SHA3-384 hash: 1793d053d6140f0c645e28e6af031d239c9b3ea85f8bb25fba31443e12e13316a7d1e441826927b722af3d605c236f5c
SHA1 hash: 95342ea854315cc31b27f1047d5a013de3cdcf23
MD5 hash: f2eac8dc1fc602439a792e0e66015f40
humanhash: vegan-sink-xray-july
File name:Payment.zip
Download: download sample
File size:410'782 bytes
First seen:2021-01-15 07:13:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:QHHHNakrdyOUe4QA9jKX/Qh2PEMSM8YknRIG:QHHHfUp9KX/uTMSM8YknmG
TLSH 9B94232C45491AFFADDF2CB8ABA3F57B038054F3118421581AB4E3B7D852611FA9BE07
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pro152-34.mxout.rediffmailpro.com
Sending IP: 119.252.152.55
From: Mohammed Zaid Keloth <zaid@enivesh.com>
Subject: Invoice Payment Confirmation
Attachment: Payment.zip (contains "Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21669.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/874f08f05b9ee2fd92c514a5b2be371a012dcc4d791d3406187968f5b0eb4288/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:14:07 UTC
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5hqr4c3t3rp3ewfcss3fprxdias3tcnpeotibqypfuplmhlikea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/874f08f05b9ee2fd92c514a5b2be371a012dcc4d791d3406187968f5b0eb4288

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 874f08f05b9ee2fd92c514a5b2be371a012dcc4d791d3406187968f5b0eb4288

(this sample)

Executable exe 8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

  
Dropping
MD5 55cb3b1b1f6fcb56f0e8d26cb8a4b8f2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

Comments