MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5978ab6b830a199251065c8a32b0a4900c73d56d605ef959430de2afbd82069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5978ab6b830a199251065c8a32b0a4900c73d56d605ef959430de2afbd82069
SHA3-384 hash: 27bfaa9974d376cd0be4d07057f9e41f8459082dc100b5da012722ff5bddb4d92374eb6e2606a8700867bffd26ed69e3
SHA1 hash: a6d8a14a2f0e5df932a44e7a2ef20a8062ddb074
MD5 hash: ff8f5705ed8a42f29bd96db86abf36c4
humanhash: video-georgia-angel-edward
File name:file.rar
Download: download sample
File size:156'456 bytes
First seen:2020-05-22 07:33:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:ZEoBdTrFVrNsOpOa67Ae2JjKK9VAHTH2PvhbLVwazh/qr6mk5:ZBLniIOamAeK17uAvHNpmk5
TLSH 6DE31247EFD1D408D3A049416E8F0A46E7782277BC342BB13B2D8E4B46AACD927594B8
Reporter abuse_ch
Tags:rar RAT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: del1.i.mail.ru
Sending IP: 217.69.138.183
From: Первый МГМУ им. И.М. Сеченова <govorov.nikolya@list.ru>
Subject: Нож в спину Трампа
Attachment: file.rar (contains "file.exe")

Unknown RAT C2:
bamo.ocry.com:8433 (207.148.126.141)

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Blocker
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:56 UTC
File Type:
Binary (Archive)
Extracted files:
35
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar f5978ab6b830a199251065c8a32b0a4900c73d56d605ef959430de2afbd82069

(this sample)

Executable exe fa2305975aded0fd0601fdab3013f8877969cb873fb9620b4d65ac6ff3b25522

  
Dropping
MD5 24b90157056913bef8c90b6319164afe
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa2305975aded0fd0601fdab3013f8877969cb873fb9620b4d65ac6ff3b25522

Comments