MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8da2bebe41b7a676eb7b9615a202f5f043068247c7b9c28fb7a9d21856da33af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8da2bebe41b7a676eb7b9615a202f5f043068247c7b9c28fb7a9d21856da33af
SHA3-384 hash: 09bdf9d5775991fec89ae874e6780701907d0cda71ce787dfbadb33c0584aaf63978a0a103c5ee3af4388b731da6d51b
SHA1 hash: 2b17285c6813849671833e8e420eadc94ec34bde
MD5 hash: b9af276c5ec57246e6091d88522c3bc1
humanhash: arkansas-queen-princess-shade
File name:OC_83015746.cab
Download: download sample
File size:742'938 bytes
First seen:2021-03-10 17:20:47 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:ylC0hXLxcGcqcPikO4IrtSb2ZYT4P80Jh3sO/+6MIWIzu6D6BN/jR0grQLjY8:ylddLuGxcPy44sMYT4fJRPWIzZu/jRC9
TLSH DDF433187C78957CF08807AC047E5191EA6D1C0A3275B4F78BCD86FAA95EDAC9D2C7C2
Reporter abuse_ch
Tags:cab Endurance


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gateway22.websitewelcome.com
Sending IP: 192.185.47.228
From: Miguel Fernandez <adquisiciones@hdhuacho.gob.pe>
Subject: ORDEN DE COMPRA
Attachment: OC_83015746.cab (contains "OC_83015746.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.28309.5840.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 17:21:10 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwrl5psbw6thn233syk2eaxv6bbqnashy644fd5xvhjbqvw2goxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/8da2bebe41b7a676eb7b9615a202f5f043068247c7b9c28fb7a9d21856da33af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

cab 8da2bebe41b7a676eb7b9615a202f5f043068247c7b9c28fb7a9d21856da33af

(this sample)

Executable exe 0f3dd18c562054da9edf8c427370c1455f5882d455ca21e8f2ed2cff9d70472c

  
Dropping
MD5 de30408e59453b090c4a82780e192a57
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f3dd18c562054da9edf8c427370c1455f5882d455ca21e8f2ed2cff9d70472c

Comments