🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dde1b44ba0d36575b9505af3b7e9ef0afbfdd46a545f35a671127e5491933710. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dde1b44ba0d36575b9505af3b7e9ef0afbfdd46a545f35a671127e5491933710
SHA3-384 hash: 422bc3df04a8342234ee5f3d033723fe7c49e6d5e8c31b6df801ce092efff3ff2549b5106c0b6850d17de3517ec6752d
SHA1 hash: 2537315568f8a27b6295b8aa68743c40dfee7fa5
MD5 hash: 393e896e9dc7f47e17771d8e04cee68c
humanhash: nuts-xray-cardinal-juliet
File name:Invoice.zip
Download: download sample
File size:479'147 bytes
First seen:2020-08-18 19:32:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BDL5YjRTtVsojrytBBuwI1XKoZMhF29QV1vL4DsM6:pMRTtCovyjBuF1LHmLGs
TLSH 2DA423194504CD37A3D98DDAEE372E530A1FCCF061C989CF8C46D7EC64AB674AA24729
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx.yiqioachina.com
Sending IP: 64.227.86.17
From: jum@yiqioachina.com
Subject: Re:INVOICE/BANK DETAILS
Attachment: Invoice.zip (contains "Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dde1b44ba0d36575b9505af3b7e9ef0afbfdd46a545f35a671127e5491933710/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:34:06 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xq3is5a2nsxlokqllz3p2ppbl573vdkkrptljtrcj7fjemtg4ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dde1b44ba0d36575b9505af3b7e9ef0afbfdd46a545f35a671127e5491933710

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip dde1b44ba0d36575b9505af3b7e9ef0afbfdd46a545f35a671127e5491933710

(this sample)

Executable exe 27d13ec8af85a7f7243aa5e0ec5fed2dd3ddf9d781fddfc00301b1317c245de8

  
Dropping
MD5 d4c5e2b4b55cd27c03f7313f8df99e6c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27d13ec8af85a7f7243aa5e0ec5fed2dd3ddf9d781fddfc00301b1317c245de8

Comments