MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5f8791e276283a2a7ab19ab8ae8ce513f66e6fe57056bdbf38de851cc0ed2e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5f8791e276283a2a7ab19ab8ae8ce513f66e6fe57056bdbf38de851cc0ed2e3
SHA3-384 hash: 4bba4cadb029184b060dd0ce8f9bc6b9e0f471d61b68eae2d25dffd556a522921f38a7d7a8db8d50915ed42d63d9cbea
SHA1 hash: c0575e9587c05da602fe2845fbac68fa3c6ed346
MD5 hash: b9f3ffa24de03f850219f48fe55e97d6
humanhash: emma-fifteen-oklahoma-don
File name:AWD 4655822861_20200929.rar
Download: download sample
File size:511'279 bytes
First seen:2020-10-14 16:19:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ElbkAyo5QxHuw9nfU7CGKa1DDMcC5fXXEAHw6OaeZv+QRO:uke5QswO7CGKyDwJ5pjOaelNO
TLSH CBB423EE889EE8DA31445F5DDB7377E3825F0CA3431CE4E2F3015BC16786225A759826
Reporter abuse_ch
Tags:rar TNT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 7hillsmarketing.ca
Sending IP: 149.56.10.215
From: TNT | Express Shipping <mohamed.zaki@al-farouk.net>
Reply-To: TNT <jelena@ultraspeed.rs>
Subject: TNT Express :Failed Delivery Notification
Attachment: AWD 4655822861_20200929.rar (contains "AWD 4655822861_20200929.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5f8791e276283a2a7ab19ab8ae8ce513f66e6fe57056bdbf38de851cc0ed2e3/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 11:25:02 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yx4hshrhmkb2fj5ldgvyv2goke7wnzx6k4cwxw7trxufdtao2lrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c5f8791e276283a2a7ab19ab8ae8ce513f66e6fe57056bdbf38de851cc0ed2e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar c5f8791e276283a2a7ab19ab8ae8ce513f66e6fe57056bdbf38de851cc0ed2e3

(this sample)

Executable exe 729796b31a6652d6ce3b87112b30cfd4ec5f7e8761b35fe1b16e39b6d12f3ea2

  
Dropping
MD5 a7e35eb572d9328860dcd9caf7a5b2b0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 729796b31a6652d6ce3b87112b30cfd4ec5f7e8761b35fe1b16e39b6d12f3ea2

Comments