MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dacd92571ce211b256ad0c2f033199c9a23056a0394ea369b8af143449411299. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dacd92571ce211b256ad0c2f033199c9a23056a0394ea369b8af143449411299
SHA3-384 hash: 97da7dcc8dbcac29991678f1fbddc2f52589b46eb58344c18c7a0bacc76f34dba96addd8afb4da56dc2b8570232841c8
SHA1 hash: ebdf319101d5add51b43f86590ec99c79f271838
MD5 hash: 90088af1711534257a5d827689ebceb5
humanhash: mobile-robert-tango-purple
File name:Swift Copy Against due Invoice.PDF.iso
Download: download sample
File size:899'072 bytes
First seen:2021-03-31 06:55:58 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:MhqjLi/OK8UbBYBC2r93TLtgWZtrOX04TSSmyanBzDHI1BsBUjdeiq2OgD:W6UBY/rF/tgwOXxh4n1k1eBliq1gD
TLSH BD15124522A1E053D3E876385F92C9B5A3B36D8D0D61826336FC3F9B37FE147981426A
Reporter abuse_ch
Tags:iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.polnacorp.cf
Sending IP: 173.82.206.16
From: KONNEX GROUP <info@konnexgroup.de>
Subject: Payment Remitance/Swift copy against due invoice
Attachment: Swift Copy Against due Invoice.PDF.iso (contains "Swift Copy Against due Invoice.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1790.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dacd92571ce211b256ad0c2f033199c9a23056a0394ea369b8af143449411299/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 06:56:07 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lgzevy44ii3evvnbqxqgmmzzgrdavvahfhkg2nyv4kdiskbckmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/dacd92571ce211b256ad0c2f033199c9a23056a0394ea369b8af143449411299

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

iso dacd92571ce211b256ad0c2f033199c9a23056a0394ea369b8af143449411299

(this sample)

Executable exe ed84be93b1bea6a1d4ed1e30d7d232d2bc6e85c480535f0b3dd94beccb2bf292

  
Dropping
MD5 501c145469d9c5e05b93b633ceeff2ba
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed84be93b1bea6a1d4ed1e30d7d232d2bc6e85c480535f0b3dd94beccb2bf292

Comments