MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 887a9c47f50a2ac28bd10f1a44e1e5a5862e018a7cdb793b8485c2c044b281c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 887a9c47f50a2ac28bd10f1a44e1e5a5862e018a7cdb793b8485c2c044b281c6
SHA3-384 hash: 416aec897bbc919d0b200ea0c487b5f4cb9bf7e197d4b1c83edb0c2495057b1888362ccfed1d896fb113c5f76ad30f9e
SHA1 hash: c6644f3374d182ba994b29753cabfafde9931d41
MD5 hash: 9fb51acb0fa9d3d55dffbb9e1fa374df
humanhash: emma-oxygen-single-potato
File name:SOA.zip
Download: download sample
File size:161'728 bytes
First seen:2020-10-19 10:24:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:BvfaH576BQtGIeTqN3bB/3/9ggO6VT5zV4REDB5ge/G08Av7DBmos:9aH5mmvwqhB/FggZVT5Z4REDBQ0thm/
TLSH 0EF31268D54203C2B7DE68A6177DECBFFFA1986ECC6108E06972844539CC582DBD8B74
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: nom-uk.com
Sending IP: 103.99.1.143
From: Alan Barboza <admin@nom-uk.com>
Subject: SOA AUG 2020
Attachment: SOA.zip (contains "SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.25687.4963.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/887a9c47f50a2ac28bd10f1a44e1e5a5862e018a7cdb793b8485c2c044b281c6/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 09:24:36 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rb5jyr7vbivmfc6rb4nejypfuwdc4amkptnxso4eqxbmarfsqhda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/887a9c47f50a2ac28bd10f1a44e1e5a5862e018a7cdb793b8485c2c044b281c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 887a9c47f50a2ac28bd10f1a44e1e5a5862e018a7cdb793b8485c2c044b281c6

(this sample)

Executable exe 8e4aac35378bc5a4743fa3d7f3e82dc81be9af5a0d0b19a98cf9c1b9570ea7ed

  
Dropping
MD5 fca617cb20ed571feb12281023cb6787
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e4aac35378bc5a4743fa3d7f3e82dc81be9af5a0d0b19a98cf9c1b9570ea7ed

Comments