MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2530bd0dfc05cf316f3ec108fc0a384eb8e72f40bc8142c3fcdb92a9d251946. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Matiex


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2530bd0dfc05cf316f3ec108fc0a384eb8e72f40bc8142c3fcdb92a9d251946
SHA3-384 hash: b2fe95058d7a1f7c832128aada5012d73defea8e730d3b42300e0662e28c07e211767f3cff0eccf8b86fea027d17ee84
SHA1 hash: 5393d177115e95a6151a19852ba4d67b984260b1
MD5 hash: ea5b92d980b8d65fbac061e3330bf9b5
humanhash: wyoming-kilo-blue-massachusetts
File name:Orders.z
Download: download sample
Signature Matiex
Create hunting rule
File size:1'289'086 bytes
First seen:2021-02-01 08:02:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:9fLJ9qeeFv5HtxZsUBcDianRwhOZxgWrupPg+FFoCIfXQC8e/F+Ys:VFwe+xjZrBcOa4qHQFFdIfAJSF+Ys
TLSH D75533C59CA41721CD009B8FE1DB23DB1331A89BB115FCE5E6F1F23A86B281B6911DD6
Reporter abuse_ch
Tags:Yahoo z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic304-21.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.242.211
From: lock.warx@yahoo.com
Reply-To: lock.warx@yahoo.com
Subject: CONCLUSION OF ORDER
Attachment: Orders.z (contains "Orders.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2530bd0dfc05cf316f3ec108fc0a384eb8e72f40bc8142c3fcdb92a9d251946/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 06:38:16 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjjqxug7ybopgfxt5qii7qfdqtvy44xubpebilb7zw4svhjfdfda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2530bd0dfc05cf316f3ec108fc0a384eb8e72f40bc8142c3fcdb92a9d251946

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Matiex

zip c2530bd0dfc05cf316f3ec108fc0a384eb8e72f40bc8142c3fcdb92a9d251946

(this sample)

Matiex

Executable exe 0b1fbc81d9d9e685307e80d20afe4b01c6538b903b77136b0d1db2486fe8c6e8

  
Dropping
MD5 e85daf3a43f107b213310a53bfd35aa9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b1fbc81d9d9e685307e80d20afe4b01c6538b903b77136b0d1db2486fe8c6e8

Comments