MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b906a4fc1d22613405715066d4649721e7ef1c7a8e8ad52f3ce789882ccba80f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b906a4fc1d22613405715066d4649721e7ef1c7a8e8ad52f3ce789882ccba80f
SHA3-384 hash: c43340eaca98818ada6a3d0b3a1787bd2bd82e77557e9b0465af7b4080be8753d96dca060ae37855246755e026d9084f
SHA1 hash: 857d2ea94d25c8eaba2344ae7727a6c71775b369
MD5 hash: fd69957fd482c4b8df8760ce6d10cca6
humanhash: mississippi-fillet-mockingbird-nevada
File name:NedBank POP.rar
Download: download sample
Signature Matiex
Create hunting rule
File size:719'626 bytes
First seen:2020-10-27 12:48:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:XgdZF9VjAHWqeRegiUyaDbNQMWIqU7KTmnxq4rce0P2a5rFED9M3IaxOMHct3fKK:e9hAmTMa3QaKcxslpKm3yMHctPKNjj8
TLSH 2CE43326D4C9AD3D926BBB913C2880D38697EC464A8F807F349D9C34CB43E1E799D274
Reporter abuse_ch
Tags:Matiex rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtprelay.b.hostedemail.com
Sending IP: 64.98.42.65
From: ACCOUNT DEPT <scheduling@safeharborchiropractic.com>
Subject: outstanding payment.
Attachment: NedBank POP.rar (contains "NedBank POP.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b906a4fc1d22613405715066d4649721e7ef1c7a8e8ad52f3ce789882ccba80f/
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 10:23:25 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xedkj7a5ejqtiblrkbtnizexeht66hd2r2fnklz446eyqlglvahq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b906a4fc1d22613405715066d4649721e7ef1c7a8e8ad52f3ce789882ccba80f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

rar b906a4fc1d22613405715066d4649721e7ef1c7a8e8ad52f3ce789882ccba80f

(this sample)

Matiex

Executable exe ccfcaf33077800cd02c88fa869e9c790bfd843c4c7968e56d4506a346a7c2d24

  
Dropping
MD5 b70896a8adc667c7ee9b9cb54f795461
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ccfcaf33077800cd02c88fa869e9c790bfd843c4c7968e56d4506a346a7c2d24

Comments