MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4ad5a58e5902178284c073527c05cb5ff2688286740353d55cbb93087bea21d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4ad5a58e5902178284c073527c05cb5ff2688286740353d55cbb93087bea21d
SHA3-384 hash: bf2901640683bb7e64a7d0c71a94ed5087bee38c4b34666039fb4e48db0f743b539996313524b4e5e0e99944a4295205
SHA1 hash: 456115a71504dd6ae1599c9348188be8995a3567
MD5 hash: a7f6343ed30aca0f4d390eb1a6b57258
humanhash: grey-hamper-green-monkey
File name:invoice.zip
Download: download sample
File size:927'441 bytes
First seen:2020-10-15 12:54:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:vUsvOFPuu4el5p7zpVMJ09nVKEhyUgO8cbgpo7JI85Ca1xDj:cnrpWeZ9yUiufO8JTH
TLSH 3B15338E919986C536D98CA82CC3C78A138FF827B199D0285C5D7DA47BBD9E5D40FBC0
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dd17118.kasserver.com
Sending IP: 85.13.137.241
From: USA BANK <admin@bmw-motorbikeparts.de>
Subject: Re: Payment
Attachment: invoice.zip (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4ad5a58e5902178284c073527c05cb5ff2688286740353d55cbb93087bea21d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 10:24:14 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2swvuwhfsaqxqkcma42spqc4wx7sncbim5adkpkvzo4tbb56uioq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d4ad5a58e5902178284c073527c05cb5ff2688286740353d55cbb93087bea21d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip d4ad5a58e5902178284c073527c05cb5ff2688286740353d55cbb93087bea21d

(this sample)

Executable exe 2c1b93f7236a800d389423b44844c9207cb5ab4047d806508d3986c058a21246

  
Dropping
MD5 7f41c805f473c71abdbf0c7b561687e4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c1b93f7236a800d389423b44844c9207cb5ab4047d806508d3986c058a21246

Comments