MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1998b1ecb213b31f99ee8332cc9753bbe1aec4d5f1b417a2a37ab1e0f3990b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1998b1ecb213b31f99ee8332cc9753bbe1aec4d5f1b417a2a37ab1e0f3990b9
SHA3-384 hash: d313070f08e45c8c629bac5ed745eb820575c862fd3ed2a2b68d18e9561dba6a154d9c89597fd5f0e1e0b94240c037c1
SHA1 hash: 7c455c5f418fd704aa0c15c6b0ed4415cf950e0c
MD5 hash: fbb8930ca3e29c8b03dbbec74ba7206c
humanhash: fourteen-blossom-lion-quiet
File name:Invoice.img
Download: download sample
File size:1'245'184 bytes
First seen:2021-01-08 19:06:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 768:KE4kRueCkSFP/7EpfaIawf61GpEpzwfueCkSFP/7EpfaIawf61GpEpzw:p4rZP8fRfREZP8fRfR
TLSH 54454AD2B3C040A6EAED46706D275A1016B2ED9984B2AB0E35CD7E2B3FF33518163657
Reporter abuse_ch
Tags:img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gmail.com
Sending IP: 103.133.105.194
From: Laurie Everett<45643936@gmail.com>
Subject: New Order - PO-KM19-141701
Attachment: Invoice.img (contains "PU8HZWNS2.0.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1493.UNOFFICIAL
Create hunting rule

Win.Packed.Clipbanker-9782972-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1998b1ecb213b31f99ee8332cc9753bbe1aec4d5f1b417a2a37ab1e0f3990b9/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-01-08 19:07:07 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugmywhwlee5td6m65azszslvho7bv3cnl4nuc6rkg6vr4dzzsc4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1998b1ecb213b31f99ee8332cc9753bbe1aec4d5f1b417a2a37ab1e0f3990b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img a1998b1ecb213b31f99ee8332cc9753bbe1aec4d5f1b417a2a37ab1e0f3990b9

(this sample)

Executable exe ba20e695d9246f21c5404b91926323782bdbeeb7e6ec5d65927f865b0af64903

  
Dropping
MD5 5c8bd68be39f86ee22126e74db4b5982
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba20e695d9246f21c5404b91926323782bdbeeb7e6ec5d65927f865b0af64903

Comments