MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a44060afccf55ebec625a177ca6c237a2a5a5c4d18c691c5cbac52423f860738. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a44060afccf55ebec625a177ca6c237a2a5a5c4d18c691c5cbac52423f860738
SHA3-384 hash: e052ace3275d7c0c8e32661e694ceb120f3312f9e35ab8353e9ba9aa20e57e8f983cfa3b46839577151f5dbc85db29e9
SHA1 hash: 59b6497ed911f7ec82a60cfe06bab9ed28b8494c
MD5 hash: 20bb3f1a3d754dc31f70a4edf6884db4
humanhash: west-skylark-venus-washington
File name:MDPO20-08.rar
Download: download sample
File size:551'578 bytes
First seen:2020-10-13 10:39:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:8HcDCq1kNYZCMfR5YjerMJLBfO/X+F87B4Krv6Kv3JIwJCNFO1eRjf9AlhIHDA8p:1k5MfRTIJLBmn75vjJUnNfqd8E3977mX
TLSH 86C433B61310FF86A7B7748F0B0CB7946C7A5E256478C129DB31C3961D1E738689A0EE
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cirtek.ph
Sending IP: 155.94.185.68
From: russel.paredes@cirtek.com.ph <russel.paredes@cirtek.ph>,
Subject: RFQ : PO#20-08 Medical support.
Attachment: MDPO20-08.rar (contains "MDPO#20-08.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a44060afccf55ebec625a177ca6c237a2a5a5c4d18c691c5cbac52423f860738/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 09:16:29 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uragbl6m6vpl5rrfuf34u3bdpivfuxcndddjdrolvrjeep4ga44a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a44060afccf55ebec625a177ca6c237a2a5a5c4d18c691c5cbac52423f860738

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar a44060afccf55ebec625a177ca6c237a2a5a5c4d18c691c5cbac52423f860738

(this sample)

Executable exe 6260dbcc6761d180c1508ecffe439c762d74b6149d1c2c48926e7e0bf0d2739f

  
Dropping
MD5 839a1a5f7caf0809b835a8be130299bf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6260dbcc6761d180c1508ecffe439c762d74b6149d1c2c48926e7e0bf0d2739f

Comments