MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d16d51f9069bfd3d36301e22f36b31826837614f9c868de0ecc9a2c374f17cb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d16d51f9069bfd3d36301e22f36b31826837614f9c868de0ecc9a2c374f17cb5
SHA3-384 hash: ca64042981e8bfa5682b69802c0b11379d2f0dc3819f0f6c81e5ee8c280d8fb729a49b1edc917bc8848295c65fbe6a91
SHA1 hash: 17cbe11befc362db88df61ed2223a89f133799c3
MD5 hash: 6ad2d3952d2ff6ee56a8841cb0b02248
humanhash: floor-bakerloo-apart-arizona
File name:견적 요청의 건 20200707_PO1757611.gz
Download: download sample
File size:525'638 bytes
First seen:2020-10-08 13:08:28 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:yqbh7HFmC04VCusbwu7apCc+ZXkdSF2ZkMxmPfF3:yq5ImsbLYv+x3ckx
TLSH BDB423531F25A4E9B0BEF80B647353E6C0781D39BD07990395A1FC0D1CBEA1A92A1E6C
Reporter abuse_ch
Tags:geo gz KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm46.hanmail.net
Sending IP: 203.133.180.234
From: 꼬맹이 <mireu02@hanmail.net>
Subject: 견적 요청의 건
Attachment: 견적 요청의 건 20200707_PO1757611.gz (contains "견적 요청의 건 20200707_PO1757611.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d16d51f9069bfd3d36301e22f36b31826837614f9c868de0ecc9a2c374f17cb5/
Threat name:
ByteCode-MSIL.Trojan.Hesv
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 12:53:35 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fwvd6igtp6t2nrqdyrpg2zrqjudoykptsdi3yhmzgrmg5hrps2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d16d51f9069bfd3d36301e22f36b31826837614f9c868de0ecc9a2c374f17cb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz d16d51f9069bfd3d36301e22f36b31826837614f9c868de0ecc9a2c374f17cb5

(this sample)

Executable exe fa57582a83943f1c2e7e82fa60aef33a429ce4d5f8ac619ed5aba917e3f30b81

  
Dropping
MD5 bfd2e3b9c171c9b0eb6e02233b25cae6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa57582a83943f1c2e7e82fa60aef33a429ce4d5f8ac619ed5aba917e3f30b81

Comments