MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0bdbbd4beefd457b5b12acfe19e6fc6d4f14cfb7572368e9be0f57b1fa934b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0bdbbd4beefd457b5b12acfe19e6fc6d4f14cfb7572368e9be0f57b1fa934b5
SHA3-384 hash: 67d7de751c07d1663e994f634903ab2dd8be3304c59cba3e291c5440c070c17137d70fe0634ee290380c9d8503eb8fee
SHA1 hash: de16bb0da6dded15bffe5398e72f7970e81a5b24
MD5 hash: 2b98c23d6b5bdac4c6e4c3adefbbbf51
humanhash: virginia-earth-crazy-seven
File name:SIWFT BANK PAPERBALANCE OVERDUE.7z
Download: download sample
File size:278'984 bytes
First seen:2020-11-16 06:56:40 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:0WcSNjikXaRcg4aydC2vbrQP7pI0F9NuzRey38Ck1J2OAZR:9VEFRF4aynvbkdhaRrsHwO2
TLSH C254236F2D668B3F8D121B3CB074F8549ABCC9105491DBBA376ECE91EB50B782D41A70
Reporter cocaman
Tags:7z SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "Steve <steve.marketing@mitrarubber.co.id>" (likely spoofed)
Received: "from mitrarubber.co.id (unknown [45.137.22.52]) "
Date: "15 Nov 2020 21:59:48 -0800"
Subject: "EMAILMING BANK PAPER FOR BALANCE PAYMENT"
Attachment: "SIWFT BANK PAPERBALANCE OVERDUE.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0bdbbd4beefd457b5b12acfe19e6fc6d4f14cfb7572368e9be0f57b1fa934b5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 04:35:04 UTC
File Type:
Binary (Archive)
Extracted files:
50
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6c63xvf657kfpnnrflh6dhtpy3kpcth3ovzdndu34d2xwh5jgs2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

7z f0bdbbd4beefd457b5b12acfe19e6fc6d4f14cfb7572368e9be0f57b1fa934b5

(this sample)

Executable exe c66121bdccdc50986ee1ec8c6820b8020ae0d1167921cb14e126dcbb327c316c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c66121bdccdc50986ee1ec8c6820b8020ae0d1167921cb14e126dcbb327c316c

Comments