MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a89ff15d13fde23d37b6d111ae6df5ef52c22422ff25b216473dee06efe87b2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a89ff15d13fde23d37b6d111ae6df5ef52c22422ff25b216473dee06efe87b2c
SHA3-384 hash: 0c1ad8bce871f1292ce65a9facc218988f7c0e4540ca4c6cdc5df084799c118754704f64518b31605f2740fd7d666e4b
SHA1 hash: 94b1844db24ca82b0ebfc4bd394ec86e356b7f0f
MD5 hash: e0e4ffd8df1a37f8b6b636f1921ffeae
humanhash: oxygen-neptune-uranus-seven
File name:Wire Payment.rar
Download: download sample
File size:231'632 bytes
First seen:2020-08-27 08:58:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Bcdw4JFtvUyAHZHXa1xBk5qJoZ5cyDRRF4Cc:BcddqZ3KxB/0DRT4Cc
TLSH EF341344A92DD7496C40027ABC9ECA79CFD7737D182A1073C166EA45AD368AFBF01C4D
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: a0122.abansys.com
Sending IP: 86.109.178.104
From: "Cindy Lopez"<Cindy.Lop@aaglobalimports.com>
Reply-To: <Cindy.Lop@aaglobalimports.com>
Subject: RE: RE: RE:UPS Shipment 779945110T:**WIRE COFIRMATION
Attachment: Wire Payment.rar (contains "Wire Payment_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a89ff15d13fde23d37b6d111ae6df5ef52c22422ff25b216473dee06efe87b2c/
Threat name:
Win32.Trojan.Crypt
Create hunting rule
Status:
Suspicious
First seen:
2020-08-27 09:02:19 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcp7cxit7xrd2n5w2ei243pv55jmejbc74s3efshhxxan37ipmwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a89ff15d13fde23d37b6d111ae6df5ef52c22422ff25b216473dee06efe87b2c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar a89ff15d13fde23d37b6d111ae6df5ef52c22422ff25b216473dee06efe87b2c

(this sample)

Executable exe 0999e53214bad0fa345666c9c92bef0b9370a6cbe38ff53a254baa2d96e2456a

  
Dropping
MD5 75800e13c234deca15444a6d44db498a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0999e53214bad0fa345666c9c92bef0b9370a6cbe38ff53a254baa2d96e2456a

Comments