MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6fe9face47873fc6ac1cf573ca4a734e940c7c9b9bca2994a6b7766965d91b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


M00nD3v


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6fe9face47873fc6ac1cf573ca4a734e940c7c9b9bca2994a6b7766965d91b6
SHA3-384 hash: 9d752e80af6e6954428a68579132c086e58f649305772fdd5324d20f5fc1344d58bfb1c1fb72f6134fc7972bd3e290d8
SHA1 hash: e2d024fe434237fe9add6250ebc314a8df92d3d8
MD5 hash: f999d31cfc328d75e3420e34ea7a87f4
humanhash: leopard-east-network-tennis
File name:PURCHASE ORDER.crdownload
Download: download sample
Signature M00nD3v
Create hunting rule
File size:353'685 bytes
First seen:2020-05-28 05:40:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:JxFZrtyxRhNGV8G/oDDCRCBb2u3qPb3ZeAxFB4yyde/WYHILUH3Z:JvZrteil4DCu3qTpRFqMOYHIC
TLSH 8574230473A540632BADA0B1D925F19E869568D073152E66DF3D6A9EA30BCDE30FCC4F
Reporter abuse_ch
Tags:crdownload M00nD3v


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: r3-66.sinamail.sina.com.cn
Sending IP: 202.108.3.66
From: VERN <qinfang899@vip.sina.com>
Reply-To: qinfang899@vip.sina.com
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.crdownload (contains "jX6sQfIYxYWWBAc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 02:37:00 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

M00nD3v

rar a6fe9face47873fc6ac1cf573ca4a734e940c7c9b9bca2994a6b7766965d91b6

(this sample)

M00nD3v

Executable exe 939fdc62cfcefb4deae6e71b84abe160c14fc6b41c787064479f607b1d5bacca

  
Dropping
MD5 5d8de378750c4d99b1bfe66162398919
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 939fdc62cfcefb4deae6e71b84abe160c14fc6b41c787064479f607b1d5bacca

Comments