MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DBatLoader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd
SHA3-384 hash: d3eb820dba9ace676a22842696348ee5fd4237d57a32886f53a124f3a35853b81c6fca4adcd32f99a0a0ecea97406702
SHA1 hash: 7959f2ad5c5a5b778622c368a3826fe6b8023169
MD5 hash: 30638d1c32abe8b252266f72e3e4fce7
humanhash: oranges-lactose-solar-montana
File name:PoonginPurchase-Order737883874.img
Download: download sample
Signature DBatLoader
Create hunting rule
File size:1'572'864 bytes
First seen:2022-08-03 11:03:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:oNZFLUG3u3e+CuySLJj7tGZJqz5d52Ep8rl:ojDVk70UForl
TLSH T156759D36B2904433D07216789D5B53A8982BBE112E78798B7BEC3D8C5F3B7913925393
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:DBatLoader img


Avatar
cocaman
Malicious email (T1566.001)
From: "joyce.pham@poongin-kr.com" (likely spoofed)
Received: "from poongin-kr.com (unknown [141.98.6.40]) "
Date: "03 Aug 2022 11:47:46 +0200"
Subject: "RE :Poongin New Purchase-Order26453784839 2"
Attachment: "PoonginPurchase-Order737883874.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.UDF.EXE-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger packed
Link:
https://www.filescan.io/uploads/62ea569cd40ca366615af531/reports/f6d68db9-4e17-4e55-8672-747fa8bfaa98/overview
Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-08-03 11:04:08 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
13 of 40 (32.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zxqab42rqe3z74opjeu4xvvuqmmmkuicg3j5y6nq6c6wnfk7p26q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DBatLoader

img cde000f35181379ff1cf4929cbd6b48318c5510236d3dc79b0f0bd66955f7ebd

(this sample)

DBatLoader

Executable exe 773a7b6da3993d34fe9593573317031ac5ae7f66ead9d8b0366274094bbe9c5a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 773a7b6da3993d34fe9593573317031ac5ae7f66ead9d8b0366274094bbe9c5a

Comments