MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd8364952bf651854b8ba8b2b2654edc3f6eaa69fc0ff1a086fb5952c47cc92d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd8364952bf651854b8ba8b2b2654edc3f6eaa69fc0ff1a086fb5952c47cc92d
SHA3-384 hash: 9957441a441c368bc4cab306e41b1b7e4601051d59971b611705f5971055ade00d7f791641f0520db86600b92ed74321
SHA1 hash: 865c0471723461c61e11d68e4bf1ad3e1367d09f
MD5 hash: 709c5916de85811ff71161f9c50d7d32
humanhash: queen-november-december-colorado
File name:offer your qotation.rar
Download: download sample
File size:66'992 bytes
First seen:2021-01-07 14:07:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 1536:toh0gcsBA0HDMpO7SrcHdEYxIDnURR7J6xK:tfgZAip7Src9KnAV
TLSH 786301786094FD7DA96485BEF513FA373A1AB35586232372343CD6006C2ABEEC045B26
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cosmo.securesvr.net
Sending IP: 139.99.69.157
From: Isaac <numbaf@yahoo.com>
Subject: Happy New Year
Attachment: offer your qotation.rar (contains "offer your qotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd8364952bf651854b8ba8b2b2654edc3f6eaa69fc0ff1a086fb5952c47cc92d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-07 14:08:15 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwbwjfjl6ziyks4lvczlezko3q7w5ktj7qh7dieg7nmvfrd4zewq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd8364952bf651854b8ba8b2b2654edc3f6eaa69fc0ff1a086fb5952c47cc92d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar cd8364952bf651854b8ba8b2b2654edc3f6eaa69fc0ff1a086fb5952c47cc92d

(this sample)

Executable exe 009df2160d76e17cc704ef5a3be2bd5aea3fd9909a2ca7585472d0fffa4c7a67

  
Dropping
MD5 d39aee65c0d31c814d8052a14c2f6eab
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 009df2160d76e17cc704ef5a3be2bd5aea3fd9909a2ca7585472d0fffa4c7a67

Comments