MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3a62494b25b0d8294a5bbe22dd495ffc9e20b7a1f5924df4071159b2889f6c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3a62494b25b0d8294a5bbe22dd495ffc9e20b7a1f5924df4071159b2889f6c9
SHA3-384 hash: fd0e7ed0187e509d89cd0eeda2d0effc57faaa136063afa596665f39ff1d57e653673f660bfb21f09eab7650075c4d6e
SHA1 hash: 2d2922fb0c242dda4dc439bfdbd1287302a2284a
MD5 hash: 5d7a0c9d42076fc706159be4a9e8b0a3
humanhash: princess-xray-uniform-carolina
File name:PO - BOA439 - 670A - 18112020.pdf.7z
Download: download sample
File size:306'232 bytes
First seen:2020-11-18 12:24:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:lIkh/P6bwv7Vu7VOFiAN+Sjqfi9JveABIavVKGhONUCkVOIoFc9:lIkB6cvU7VQiAqa9JmABI8VKScUCtS
TLSH 1C542326C06165CD301BFFE20598C9BA9C0C12DC958B0B856B76ABD88A1F4D5F9E1C7E
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gmail.com
Sending IP: 192.158.238.82
From: ASELKON KAMPÜS HİDROLİK <aselkonmuhasebe@gmail.com>
Subject: Attached Order
Attachment: PO - BOA439 - 670A - 18112020.pdf.7z (contains "PO# - BOA439 - 670A - 18112020.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23581.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3a62494b25b0d8294a5bbe22dd495ffc9e20b7a1f5924df4071159b2889f6c9/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:25:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yotcjffslmgyffffxprc3vev77e6ec32d5msjx2aoekzwkej63eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip c3a62494b25b0d8294a5bbe22dd495ffc9e20b7a1f5924df4071159b2889f6c9

(this sample)

Executable exe deb787123698fbdeae3c8561b4c7fef3e01ac5443519661c644608dc9df85867

  
Dropping
MD5 aeb9c86a931fc3e0f6ded9a831cc1113
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 deb787123698fbdeae3c8561b4c7fef3e01ac5443519661c644608dc9df85867

Comments