🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c121c811c1011e992bfc9a0ca1a72d5b20d9acb0dc21bb47f1576958e58a40ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c121c811c1011e992bfc9a0ca1a72d5b20d9acb0dc21bb47f1576958e58a40ea
SHA3-384 hash: 4770679da9f12689328d44c19ff39422661ccb59315a2c0b409669b5d17404ab232f0da42de2198227011775f1a85e0f
SHA1 hash: 4053897b6ca57aed4a5db5ecb4de47a7eacf5949
MD5 hash: 6b35b7a8139d4c139331f9ab96430001
humanhash: low-delaware-two-gee
File name:NEW_ORDER.IMG
Download: download sample
File size:1'245'184 bytes
First seen:2020-08-14 10:41:47 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:TfeN1UyLxg1wurMcplbEsVYRIpXWfOjTOV:Tf1yVCwGMSSipXUOfOV
TLSH 3B459D05F7A1AF01D2E42574D1A309364BE6E5873276F38E3F0D46E26E122B49D9E3C6
Reporter abuse_ch
Tags:img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: setentaycinco14.nsprimario.com
Sending IP: 188.93.75.14
From: Zhukeng Cooperative Co., Ltd <donatella@fabiorusconi.it>
Reply-To: michaltony2020@gmail.com
Subject: Re:Re:Re:Re:Re:New Order_WR-088399R_doc(3)_109.818,52€
Attachment: NEW_ORDER.IMG (contains "New Order NN.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.MSIL.Bladabindi.1.27264.4310.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c121c811c1011e992bfc9a0ca1a72d5b20d9acb0dc21bb47f1576958e58a40ea/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:43:07 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yeq4qeobaepjsk74tigkdjznlmqntlfq3qq3wr7rk5uvrzmkidva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c121c811c1011e992bfc9a0ca1a72d5b20d9acb0dc21bb47f1576958e58a40ea

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img c121c811c1011e992bfc9a0ca1a72d5b20d9acb0dc21bb47f1576958e58a40ea

(this sample)

Executable exe 383e589441b2d47da8108e096dcbef6501935e91f248158a624bed91fef1524c

  
Dropping
MD5 2d406193a862c4cd680d732667d5550e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 383e589441b2d47da8108e096dcbef6501935e91f248158a624bed91fef1524c

Comments