MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf40e1ec36f44e20a9744e8038987527027e2a6ee7e96d9044842f92ece9d7e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Loda


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf40e1ec36f44e20a9744e8038987527027e2a6ee7e96d9044842f92ece9d7e8
SHA3-384 hash: 91800c535a8cbadd051fa7bcd8071f8f3b6ba77e7465f9e299eb5e9d21b8a3254f28a0260f4f3a6acd6feaff2cf8dbda
SHA1 hash: 7fb823deed5f5f071bc8478fffc8da388c040ae9
MD5 hash: 2d5c61935f9d870e940ec8e7c42ae26b
humanhash: cup-triple-snake-five
File name:Pictures.REV
Download: download sample
Signature Loda
Create hunting rule
File size:834'354 bytes
First seen:2020-08-10 09:13:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:iADx1VxayqsUw5sXxKDwvkndn3Ur0TSMt:r1i/pRXxKEg3Ur0zt
TLSH B5053390256CAD80689E9A630E61BEDB094F340F4544F797686ED24DC2DD9EFC26C0FD
Reporter abuse_ch
Tags:Loda rev


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: antirelay04.smtp.cz
Sending IP: 81.95.105.134
From: asistentvyroby@oceng.cz
Subject: New Quotation Needed.
Attachment: Pictures.REV (contains "Pictures.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf40e1ec36f44e20a9744e8038987527027e2a6ee7e96d9044842f92ece9d7e8/
Threat name:
Script-AutoIt.Trojan.Nymeria
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:15:07 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5aod3bw6rhcbkluj2adrgdve4bh4kto47uw3eceqqxzf3hj27ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cf40e1ec36f44e20a9744e8038987527027e2a6ee7e96d9044842f92ece9d7e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Loda

rar cf40e1ec36f44e20a9744e8038987527027e2a6ee7e96d9044842f92ece9d7e8

(this sample)

Loda

Executable exe 38e5fde6988bbf02467d7b59ba15a3dfbdaedfab4804c60cf3ae44db6b48a844

  
Dropping
MD5 75424d3f8d44675c38d63c79b22aef1b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38e5fde6988bbf02467d7b59ba15a3dfbdaedfab4804c60cf3ae44db6b48a844

Comments