MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fafc23483e7feb9caad51c7375b06dcdd8461fa4d8123d4abb92287bcb731c97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fafc23483e7feb9caad51c7375b06dcdd8461fa4d8123d4abb92287bcb731c97
SHA3-384 hash:	3e3eeec0fde35a49d9e53d7f83ed9bf05ad578c5e7e741ba3e7dc87ed92ace76d3a9426925bf84127c73bfe8fd8a46ae
SHA1 hash:	9823085898d5bb093d3aa00cec5a1c8e742ded59
MD5 hash:	7b9720e4c977f2ac2169f205e9c3dcfb
humanhash:	hawaii-lake-neptune-floor
File name:	RTUY0389_6006233.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	366'121 bytes
First seen:	2023-10-11 23:28:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: W1289
ssdeep	6144:i25ePdu3AW82I2z94uu0CeQjps+MGNosoYNQmu1NGHKiWExEK4GbuaWfr3WnN/DK:iHPoFa2p4z0OpsNG2soYNQFClEKpyaav
TLSH	T1727423AD8D9798B11D6A677E45FBBC2CDD073970C19D2F9D20236C197006E3A63CAD81
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	gestionhqse-com IcedID p-W1289 pw-W1289 zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

179

Origin country :

IT

File Archive Information

This file is a password protected archive. The password is: W1289

This file archive contains 2 file(s), sorted by their relevance:

Relevant files 2

File name:	Readme[2023.10.11_08-07].txt
File size:	171 bytes
SHA256 hash:	d10d5f170e6e4cf71bef6661dddd3dbb9d7b6b558f5802a88540ff527309628d
MD5 hash:	6d1ae4d6fc6d7eed56ed205328734b51
MIME type:	text/plain
Signature	IcedID

File name:	document[2023.10.11_08-07].vbs
File size:	1'037'263 bytes
SHA256 hash:	c1ef40e8ab20ce2ae541a4b2a21de4ccedd94a212d049b39ea392959cecb0106
MD5 hash:	76461b5f5b53971ee56faeb25cdcd9af
MIME type:	text/plain
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fafc23483e7feb9caad51c7375b06dcdd8461fa4d8123d4abb92287bcb731c97

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fafc23483e7feb9caad51c7375b06dcdd8461fa4d8123d4abb92287bcb731c97/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7l6cgsb6p7vzzkwvdrzxlmdnzxmemh5e3ajd2sv3siuhxs3tdslq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.