MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe348b59971ebd492fb728aa14260574cd4f642a0725fbd476b10dd1d63daa7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe348b59971ebd492fb728aa14260574cd4f642a0725fbd476b10dd1d63daa7b
SHA3-384 hash: 8785f7132e5bb7936a438a0684e57c216ff3291f154ba798c70cd14642a1ecb0f6ed3b3f9a39ee8ce3532632a94e531d
SHA1 hash: edd89e72b497b2c1e3e8bb623ce5ee6b9953c17c
MD5 hash: 4695fb7b61cca2b5d77c5dfc0910c3a6
humanhash: ink-happy-september-carolina
File name:Mahavir_Group.zip
Download: download sample
File size:347'337 bytes
First seen:2020-11-06 17:31:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:12g+Y3/bJwvyzVtE1O4G1A9PmHl/VCSo3hwXlKbkMuTQMI0y+lqsHTonCNy/DYRd:1xJ9wvypZ4kA9PmF/yhKP0MI08skndLC
TLSH F474237C458A1F9BBCCC58AC8BA7F91B0A8857EB134875485DDD73B78009602F95F90B
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: WIN-L66T98C3SA5
Sending IP: 45.120.139.134
From: shiprecycling@mahavirgroup.co.in
Subject: Payment Confirmation From Mahavir Group
Attachment: Mahavir_Group.zip (contains "Mahavir_Group.cmd")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Malware.43883.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe348b59971ebd492fb728aa14260574cd4f642a0725fbd476b10dd1d63daa7b/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 11:43:45 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7y2iwwmxd26usl5xfcvbijqfotgu6zbka4s7xvdwweg5dvr5vj5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip fe348b59971ebd492fb728aa14260574cd4f642a0725fbd476b10dd1d63daa7b

(this sample)

Executable exe 8330fe82dcc9461a750d34f5fb88c161f0a79fe2d235f21c4c0fc7abb001b5c9

  
Dropping
MD5 7368bf8d1cd631c857fdcd4a3672e737
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8330fe82dcc9461a750d34f5fb88c161f0a79fe2d235f21c4c0fc7abb001b5c9

Comments