MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbe6d38450756c8ca82a40a7caadb9893b6ba4c01a3fdb0fccee63fd1b633581. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbe6d38450756c8ca82a40a7caadb9893b6ba4c01a3fdb0fccee63fd1b633581
SHA3-384 hash: 0e71357757a6d2cd8d6e9504758b02e98b909961860a5658d06da677724db125ebbbb702ef01ba400cc423f0975028d8
SHA1 hash: 6f50fe410e968c86163eaa1441f836e0c4ba11f9
MD5 hash: 15c69c4d6dc1f992b4a426466740af81
humanhash: pip-delta-sierra-kentucky
File name:Proof of Payment pdf.cab
Download: download sample
File size:814'445 bytes
First seen:2020-05-13 10:32:38 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:pH9vvaLdgoMhGdxjH3GhdFHN63I7xk1RMwVi+pn:59vvIrtHWhB63ItkXMexV
TLSH 6E0533B3DB1A83EACC4B643452488B8F1537C58FF41558EDC99027B059B6EB160DAEEC
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: a2nlsmtp01-05.prod.iad2.secureserver.net
Sending IP: 198.71.225.49
From: Capitec Bank <No_reply@capitec.co.za>
Reply-To: No_reply@capitec.co.za
Subject: Payment Notification
Attachment: Proof of Payment pdf.cab (contains "Proof of Payment pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Autoit-7600991-0
Create hunting rule

Win.Malware.Autoit-7600992-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ptnhbcqovwizkbkict4vlnzre5wxjgadi75wd6m5zr72g3dgwaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

cab dbe6d38450756c8ca82a40a7caadb9893b6ba4c01a3fdb0fccee63fd1b633581

(this sample)

Executable exe 3b671c3d24db562f33df95a58e3aa4a74c33cc07a4a609804d1d11fab98c18cc

  
Dropping
MD5 f107d869f3d2a6fa457eabe23022ab1e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b671c3d24db562f33df95a58e3aa4a74c33cc07a4a609804d1d11fab98c18cc

Comments