MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9b766deb22aef214fdab2e4e8eecc634ed87bc6d36e451b2a1cd105d6b89296. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9b766deb22aef214fdab2e4e8eecc634ed87bc6d36e451b2a1cd105d6b89296
SHA3-384 hash: 83efccaee9a73d77301d8631efffeeccfe25e81ec3057b521c9e4f90bc7d4878d3106aa6398d739357c8cf9b0bd962de
SHA1 hash: f266a3b20876ca013984d5485322023ad0745510
MD5 hash: 098034ad538c82a3538f26748ddaff6a
humanhash: mockingbird-jig-six-mexico
File name:ORDER 29883498.xlsx.zip
Download: download sample
File size:12'719 bytes
First seen:2020-10-10 06:59:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 192:6lTA12qzHBpRAP7XpyeTfh9AI3FlAtFMkJ8X17KR5UmwpBl80ShsyrCaX:6BAUXpxfh9n1lAtFGluRwi0Is8X
TLSH B042D0910C2C374FE0D1D5988AFA1D88F180432F7326ED4C0AF692F5D1C969842AFAA1
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: yandex.com
Sending IP: 156.96.47.42
From: ARSHAD - PROCUREMENT <sales.bmh-global@yandex.com>
Subject: rfq_Purchase Order (PO_Quote#202010-09)
Attachment: ORDER 29883498.xlsx.zip (contains "ORDER 29883498.xlsx.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9b766deb22aef214fdab2e4e8eecc634ed87bc6d36e451b2a1cd105d6b89296/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 23:06:16 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zg3wnxvsflxsct62wlsor3wmmnhnq66g2nxekgzkdtiqlvvyskla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c9b766deb22aef214fdab2e4e8eecc634ed87bc6d36e451b2a1cd105d6b89296

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip c9b766deb22aef214fdab2e4e8eecc634ed87bc6d36e451b2a1cd105d6b89296

(this sample)

Executable exe dd95e88ac14886f8137d19be31a66a5eea0c3e03933ab8fbeeb2f65e28fdd3fd

  
Dropping
MD5 241b8a96c27d42a1b63848c020bf577f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd95e88ac14886f8137d19be31a66a5eea0c3e03933ab8fbeeb2f65e28fdd3fd

Comments