MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc1309cca8c5ad5eb5a7712d3c40d85527e7a0fb47c0f21d8881a295fd09e10e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc1309cca8c5ad5eb5a7712d3c40d85527e7a0fb47c0f21d8881a295fd09e10e
SHA3-384 hash: 48ccec2174dac913b2e7958b872812de1e2bcad85006bdd44641a93083cc7ceed1ff409f6dfde8f24703468fb15454f0
SHA1 hash: 1d7620faac7f2795a164681af7d12e7fd66b5aef
MD5 hash: bf70deca054f5e54d330d28e559fd0a2
humanhash: mars-salami-whiskey-charlie
File name:file.zip
Download: download sample
File size:1'462'272 bytes
First seen:2021-01-18 07:38:24 UTC
Last seen:Never
File type: tar
MIME type:application/x-tar
ssdeep 3072:PxY9uv8/GvVovJN3zVf+kMcds+Mp9fwBp3KikTgShsYX:qi8OavzVf+kBds+M7
TLSH 77656CA85DA76E39D433275F51A4E849D3004F7827EA479673FBE7A83A036054B08DBC
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gunjimwa.com
Sending IP: 68.183.65.32
From: Rose Vu<sales.rosevn@gmail.com>
Subject: Order -6103
Attachment: file.zip (contains "ff3382b73eee7ce53fe8e146ea35d41b.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisCA9CC86FD540.22241.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc1309cca8c5ad5eb5a7712d3c40d85527e7a0fb47c0f21d8881a295fd09e10e/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-18 07:39:05 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqjqttfiywwv5nnhoewtyqgykut6pih3i7apehmiqgrjl7ij4eha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc1309cca8c5ad5eb5a7712d3c40d85527e7a0fb47c0f21d8881a295fd09e10e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

tar cc1309cca8c5ad5eb5a7712d3c40d85527e7a0fb47c0f21d8881a295fd09e10e

(this sample)

Executable exe 4068c9a37394e76960df6bb73d88760be0371af77a12816346f241d5b1ce1233

  
Dropping
MD5 ca9cc86fd540cf7a0149e4d440bfdaf1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4068c9a37394e76960df6bb73d88760be0371af77a12816346f241d5b1ce1233

Comments