MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5db1a7a4af4395cb8aa7e12a9149e9a3f4a827b3ef310d534a394196a0d0872. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5db1a7a4af4395cb8aa7e12a9149e9a3f4a827b3ef310d534a394196a0d0872
SHA3-384 hash: bc037fcf66dba24e8586afde22d95688d0b73afb6d50c8707a53f9b0d87f93b3983ea455f5e31d06741b59b21c89fd1d
SHA1 hash: b2e67e73451dda5d7c9583ec05c78fea965b108f
MD5 hash: 08202c1bec383a725277c1f1afb4610a
humanhash: orange-sink-mars-april
File name:Cargo AIRLINES CSR.zip
Download: download sample
File size:205'155 bytes
First seen:2020-11-17 19:53:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:hx+2kNUSbDD2txUD4yLo6jznvRhMZLYpZ5XTyFnd:kNPPitxUHLZjRe0pZ5DyFnd
TLSH 6E1422C13C1ED82506835BAA06EC725CA224DB4311ECA7A717B036ACBF3C595CE65DBC
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Ashish Jain" <office@nhaiderbd.com>" (likely spoofed)
Received: "from nhaiderbd.com (unknown [103.99.1.143]) "
Date: "17 Nov 2020 09:20:51 -0800"
Subject: "Cargo AIRLINES CSR 2ND FN Nov-2020"
Attachment: "Cargo AIRLINES CSR.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201117-1609.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5db1a7a4af4395cb8aa7e12a9149e9a3f4a827b3ef310d534a394196a0d0872/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 18:04:36 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxnru6sk6q4vzofkpyjksfe6ti7uvat3h3zrbvjuuokbs2qnbbza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip c5db1a7a4af4395cb8aa7e12a9149e9a3f4a827b3ef310d534a394196a0d0872

(this sample)

Executable exe a328acf6d3bec1a1f6f3b304d6aac3ecdf36d074bb398e8d0245423ddbb9fc72

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a328acf6d3bec1a1f6f3b304d6aac3ecdf36d074bb398e8d0245423ddbb9fc72

Comments