MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc4e71de1d044cb5f09876658d71002f11243d6d226ffef9aa084923e265b4c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc4e71de1d044cb5f09876658d71002f11243d6d226ffef9aa084923e265b4c1
SHA3-384 hash: 9845f3863505a6432dc43205d85eb809c290402aa1aa9812d2122ce2a0845d7c668204750797c7d166cbb0d9b155fd96
SHA1 hash: 6ed2fa1fd97bd6c2643128720796f86e420dac1d
MD5 hash: 8056cb70fc77b4746dfcd1a3bc220e9e
humanhash: texas-oscar-dakota-edward
File name:122483101396W2 ALS_BANK WIRE CONFIRMATION SLIP.IMG
Download: download sample
File size:1'245'184 bytes
First seen:2020-10-15 13:10:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:Lnrw40JRdQk7CpaHYDbU00v7X4Z8tg/77Y+JvJkJ:Lnr2JRdnDYqEZ8GvJvJkJ
TLSH 12455EC4790CEC12EAB6D17C5DA9CCB9B6F02F1D2554C51E0FDF8ADAC0F00AA99A6D11
Reporter abuse_ch
Tags:img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: jax4mhfb02.myregisteredsite.com
Sending IP: 64.69.218.95
From: orders <orders@echoproducts.com>
Reply-To: orders <orders@echoproducts.com>
Subject: Fwd: INV#22483101396 , INV#22483101788 BANK WIRE CONFIRMATION SLIP
Attachment: 122483101396W2 ALS_BANK WIRE CONFIRMATION SLIP.IMG (contains "122483101396W2 ALS_BANK WIRE CONFIRMATION SLIP.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc4e71de1d044cb5f09876658d71002f11243d6d226ffef9aa084923e265b4c1/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 11:35:49 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rhhdxq5argll4eyozsy24iaf4isiplnejx756nkbbeshytfwtaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dc4e71de1d044cb5f09876658d71002f11243d6d226ffef9aa084923e265b4c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img dc4e71de1d044cb5f09876658d71002f11243d6d226ffef9aa084923e265b4c1

(this sample)

Executable exe f079f9b485df898c6cbfbacbd9533eeec33e226c79da64f95a3e1e6e751d8d98

  
Dropping
MD5 3c0eae2865775a4d270dbbf18eb183ae
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f079f9b485df898c6cbfbacbd9533eeec33e226c79da64f95a3e1e6e751d8d98

Comments