MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11e5fa7daabe1d1eb2fc665a6c3a0f4926b9a927016f3c7edf7c2839a7a7ebfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11e5fa7daabe1d1eb2fc665a6c3a0f4926b9a927016f3c7edf7c2839a7a7ebfa
SHA3-384 hash: e7126abe791ba8b582471b6de0eb9169a9b3fd346ab70c69f7422872ada9e5ffe8069d883a9c85caff74890decbfea58
SHA1 hash: 685ed23e6031eb9c8c5001eaece73bc177800bd6
MD5 hash: 73d6b9b9649796f90e62eabd0bfe515c
humanhash: indigo-illinois-eleven-oklahoma
File name:Purchase Order.rar
Download: download sample
File size:397'405 bytes
First seen:2020-07-23 04:49:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:aV0UEn7htDxRyEouaZTmEz08/tE8XfWNrOYVoV77K9YrruMELE4vlTWAitsp:Xb3FofJtpfOBoV77mQezJ
TLSH F684237F3B5A292122CEC130A9366331366C8C510E8F4D1F758C3EF252A9991DF8686B
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: Johnson owen<salesdesk@featherliteladders.com>
Received: from featherliteladders.com (unknown [95.211.208.23])
Date: 22 Jul 2020 23:58:12 -0700
Subject: Re: Purchase Order
Attachment: Purchase Order.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25065.RarHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11e5fa7daabe1d1eb2fc665a6c3a0f4926b9a927016f3c7edf7c2839a7a7ebfa/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 04:51:05 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=chs7u7nkxyor5mx4mzngyoqpjetltkjhafxty7w7pqudtj5h5p5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/11e5fa7daabe1d1eb2fc665a6c3a0f4926b9a927016f3c7edf7c2839a7a7ebfa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 11e5fa7daabe1d1eb2fc665a6c3a0f4926b9a927016f3c7edf7c2839a7a7ebfa

(this sample)

Executable exe a7d41b30da9b194975624810d584916436138a21610ba386fbde6e9dab68428d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7d41b30da9b194975624810d584916436138a21610ba386fbde6e9dab68428d

Comments