MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa49e1696857d4c2c8b6e7a9b9d5ec8586b084a002ba525177598777a704a73b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa49e1696857d4c2c8b6e7a9b9d5ec8586b084a002ba525177598777a704a73b
SHA3-384 hash: feae2a2f471157e1f26f26016054b7d8a7ede9f9293ae5d7865e219e150c42c03f3043a4fceb40105bb56e43b674aa0d
SHA1 hash: 352d089af2ffeb772ec93dcb337fc53773fb4aaa
MD5 hash: 313c73040c6a0557540612d353bc01a5
humanhash: batman-double-oven-triple
File name:EES 94-20 RFQ____pdf.zip
Download: download sample
File size:42'254 bytes
First seen:2020-10-19 13:12:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:XCOIOPziV0uKcur39AtH+rW32JDCJm03B0xVArVBwHKy0JOGwlIHF:X5RururtBDDJ5VwV+HKXBMIl
TLSH 0C130263022C1FD5852C9819C2C84DC46383E43F9EC129CE7BB79866659CFF81AC5ED8
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: e-server.org
Sending IP: 111.221.44.74
From: EES - SALES <sales@ees-oman.com>
Reply-To: EES - SALES <sales@ees-ornan.com>
Subject: EES 94-20 Query RFQ
Attachment: EES 94-20 RFQ____pdf.zip (contains "EES 94-20 RFQ____pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa49e1696857d4c2c8b6e7a9b9d5ec8586b084a002ba525177598777a704a73b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 10:40:43 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7je6c2lik7kmfsfw46u3tvpmqwdlbbfaak5feulxlgdxpjyeu45q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/fa49e1696857d4c2c8b6e7a9b9d5ec8586b084a002ba525177598777a704a73b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip fa49e1696857d4c2c8b6e7a9b9d5ec8586b084a002ba525177598777a704a73b

(this sample)

Executable exe 89616d0300548c28fd2ca5e35e51c4b299c5e36e293257a9ba558c946c221adc

  
Dropping
MD5 bd47ada97accccb2fc617d1f7f9f79f0
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89616d0300548c28fd2ca5e35e51c4b299c5e36e293257a9ba558c946c221adc

Comments