MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faec6590b2ddf3e22b08564c06b4907c43c0245b7b0858f6514ba028f05bc15d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faec6590b2ddf3e22b08564c06b4907c43c0245b7b0858f6514ba028f05bc15d
SHA3-384 hash: 422fceacfe713b4034027775e0aebd4398fbd49e47017ae0927844c4195e641a44e6798b80a4bf112a4753d0bef75237
SHA1 hash: 36ebb9c890192c5d70dcf5f86d7cc5bce211f601
MD5 hash: 279d68cd8838922c89d1929e2f94e337
humanhash: nitrogen-island-carolina-orange
File name:tmp_yykrj31
Download: download sample
File size:123'861 bytes
First seen:2022-02-09 15:10:19 UTC
Last seen:Never
File type:unknown
MIME type:application/CDFV2
ssdeep 3072:4dcKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgGB2:ScKoSsxzNDZLDZjlbR868O8KlVH37ken
TLSH T1ABC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473249B32F7D76590CA12706
Reporter Cryptolaemus1
Tags:Emotet epoch5

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.CROStringBuilderHidingPlacesPapaDontTakeNoMess.20200916.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CROKissFromARose.M4.20201215.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.PowerShell.Agent-19.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLB64INVOKEDASHWINVOKEDASHW.3.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PDATARootDown.20220203.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.4.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.4.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD._OUTFILE.220203B64.2.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe macros macros-on-open
Link:
https://www.filescan.io/uploads/6203d990c79b424d720b4574/reports/cd987da0-7045-48a3-93be-cf8840574240/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faec6590b2ddf3e22b08564c06b4907c43c0245b7b0858f6514ba028f05bc15d/
Threat name:
Script-Macro.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 15:11:10 UTC
File Type:
Document
Extracted files:
28
AV detection:
14 of 42 (33.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments