🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8896e338d4b9c19eb9c1bec5e01dfea8bc4543b6750f2894775870e883ff9756. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8896e338d4b9c19eb9c1bec5e01dfea8bc4543b6750f2894775870e883ff9756
SHA3-384 hash: 5b6973abb08191d7b07b7d18b32afe83df3030b8e21de25d36a4ea68d20e748ba8bcd55784464a7ec6b2063324801327
SHA1 hash: f39c320a05ee0539100116e8778a3bba1235dd81
MD5 hash: 3a44aae3cc0304aba98244b4c0b1808a
humanhash: winter-oscar-skylark-artist
File name:Pranešimas apie mokėjimą.pdf.img
Download: download sample
File size:2'621'440 bytes
First seen:2020-11-05 10:09:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:nGXFdFgkPEn+dMqJpAB4hG7RHcBZGsZP3SgYUS9YDndH:GVdWG6+qDl7CGYPCC8unt
TLSH 74C56C27398384A8C8252572467DD9D063B1BBCF37258B1E32875368DF432AB371B65E
Reporter abuse_ch
Tags:geo img LTU Swedbank


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.doklsa.us
Sending IP: 185.249.197.82
From: Swedbank AB <info@swedbank.lt>
Subject: Pranešimas apie mokėjimą
Attachment: Pranešimas apie mokėjimą.pdf.img (contains "Pranešimas apie mokėjimą.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.47142.4160.5412.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8896e338d4b9c19eb9c1bec5e01dfea8bc4543b6750f2894775870e883ff9756/
Threat name:
ByteCode-MSIL.Hacktool.Lore
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 23:40:22 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rclogoguxhaz5oobx3c6ahp6vc6ekq5wouhsrfdxlbyora77s5la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img 8896e338d4b9c19eb9c1bec5e01dfea8bc4543b6750f2894775870e883ff9756

(this sample)

Executable exe eea1286b7f160f458a376a7c640b076ac424fa2bdeb8460488715f8989152de2

  
Dropping
MD5 8601b471a1acbd6fb19b478b80c7b775
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eea1286b7f160f458a376a7c640b076ac424fa2bdeb8460488715f8989152de2

Comments