MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72
SHA3-384 hash: 97f67ca4864ffed1969d7157feaa6eb1a5bdfe0eab17807bf2c18981e77ca3f05d04b30f81db88415abd13f8d5ec6889
SHA1 hash: a839aced7d5a6d5793e39e6f62c1b5cf5a446c5f
MD5 hash: e962628afcce0555900bc6fb00740b1f
humanhash: mango-burger-rugby-angel
File name:CamScanner-04052021.PDF.zip
Download: download sample
File size:715'413 bytes
First seen:2021-04-06 05:42:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:J6sxqD3a1XgrrpiHehrRXiPTxpVeLpKszVjuN1t977XMTkhNVG06RLjXkV:J693aQo+h9XitpVWY4C1ffXMIULRLm
TLSH 79E4239F15CA4A997273666A39B281737B2834DC2BBBDC4CD2D0CB6A44EDF1C79C4520
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Tram Man <tram@ctcbio.com.vn>" (likely spoofed)
Received: "from mx1.rada.cv.ua (mx1.rada.cv.ua [185.46.188.30]) "
Date: "Mon, 05 Apr 2021 23:23:48 +0000"
Subject: "=?UTF-8?Q?Re=3A_Re=3A_Re=3A_Re=3A__Y=C3=AAu_c=E1=BA=A7u_h=C3=B3a?=
=?UTF-8?Q?_=C4=91=C6=A1n_chi=E1=BA=BFu_l=E1=BB=87?="
Attachment: "CamScanner-04052021.PDF.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25510.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25553.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 05:43:06 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5cqzvodgvdsmhnqitgk4yjxtw7nehdenstzvofmdvie7bfg55zza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip e8a19ab866a8e4c3b6089995cc26f3b7da438c8d94f3571583aa09f094ddee72

(this sample)

Executable exe 5501a072a478f1b6c6045154d4b3e5c102c5da98041f503d80b8a2b50bb6b85b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5501a072a478f1b6c6045154d4b3e5c102c5da98041f503d80b8a2b50bb6b85b

Comments