MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abdbbde79b28deb4440dd2293d04594cc6638acb10c8ae946b49d0760227e376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abdbbde79b28deb4440dd2293d04594cc6638acb10c8ae946b49d0760227e376
SHA3-384 hash: e4fa004b63e0bad0bac8523b864a9a4b82f981f1c7a98fa3c95f9e6375446c3bedc8701184ced5c78a05bec241d1f1f0
SHA1 hash: e8d49364d4c958b9c62a617c3c1f5a26e858b496
MD5 hash: bcea9effc6471742479666c5d5f50402
humanhash: whiskey-north-apart-don
File name:Ostutellimus_pdf_______________________________.gz
Download: download sample
File size:558'129 bytes
First seen:2020-10-08 17:39:48 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:eNSBhTY6divCbj3BtK1IGqH38PRq/ck8AzhTgpKJuGl9Z2C6mGW:eIXTmeDZzhhEGUC6E
TLSH E8C42377075AF47A752E11B03A3FDF655C192081C22E4C7BBB4A53349DAEAF15828C39
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: auto-deal.gr
Sending IP: 45.137.22.56
From: Sebastian<xasapi@auto-deal.gr>
Subject: RE: Ostutellimus
Attachment: Ostutellimus_pdf_______________________________.gz (contains "Ostutellimus_pdf_______________________________.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abdbbde79b28deb4440dd2293d04594cc6638acb10c8ae946b49d0760227e376/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 08:27:59 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpn33z43fdpliran2iut2bczjtdghcwlcdek5fdljhihmarh4n3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/abdbbde79b28deb4440dd2293d04594cc6638acb10c8ae946b49d0760227e376

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz abdbbde79b28deb4440dd2293d04594cc6638acb10c8ae946b49d0760227e376

(this sample)

Executable exe 6db0acaf93c96f9f60fbb40861f31c1c195c460814e927b8abc81c738353f4c7

  
Dropping
MD5 fb0c391e87a2eadb2b6411f93a95697d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6db0acaf93c96f9f60fbb40861f31c1c195c460814e927b8abc81c738353f4c7

Comments