MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad1819361e422b34b3d0abbfe142783258374f3eb4e4a80c219832433f5cefbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad1819361e422b34b3d0abbfe142783258374f3eb4e4a80c219832433f5cefbd
SHA3-384 hash: 23da84f66b2e6d32142154a6073ed35bdca8a2070d082f034fed0cc9ac2ebad99fa39c2d6b3dec36b1110a5a701a3ece
SHA1 hash: 55c168b565b9b9f11ca923da9cf5014023170ff9
MD5 hash: 5de937d941caad207560aa31ffda9e01
humanhash: tango-north-vegan-wolfram
File name:PR200701149.gz
Download: download sample
File size:687'021 bytes
First seen:2020-10-07 05:05:54 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:SKKK7hoaRcHVmeK/4BvmrgEwMhXS7KZw6PmsPcz1kBQ3JiuazKaDvoSp:TKEhoayHVDa4r4XS+e6PmsPgkBuiRzKK
TLSH 0DE42387379C26211C3F3F2FED9841C6C00B291E76E79849E49D514A96A71C82FF1DDA
Reporter abuse_ch
Tags:gz Strato


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mo4-p04-ob.smtp.rzone.de
Sending IP: 85.215.255.124
From: Greg Kemp <info@assag.de>
Subject: FW : Swift
Attachment: PR200701149.gz (contains "PR200701149.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad1819361e422b34b3d0abbfe142783258374f3eb4e4a80c219832433f5cefbd/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 02:10:14 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vumbsnq6iivtjm6qvo76cqtygjmdotz6wtskqdbbtazegp24566q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad1819361e422b34b3d0abbfe142783258374f3eb4e4a80c219832433f5cefbd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz ad1819361e422b34b3d0abbfe142783258374f3eb4e4a80c219832433f5cefbd

(this sample)

Executable exe 54ea0b0567e7fcbd6f0a0a179f607d901f597c682627958d0d76e7d7460b148b

  
Dropping
MD5 d12953f6b9c88a9e5d61368cff50b421
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 54ea0b0567e7fcbd6f0a0a179f607d901f597c682627958d0d76e7d7460b148b

Comments