MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14328960236fbf16dbee6e047a95f5a77eb9ba348466e3b488c80fc340e7aaae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14328960236fbf16dbee6e047a95f5a77eb9ba348466e3b488c80fc340e7aaae
SHA3-384 hash: 01a006b26c180a10841799af6dc6b611f0b1ceef8558f8159c7d960865dce311a0a516953dca7de8209af8e9eac00c7e
SHA1 hash: 001b5ecbe840b643c5ddb5723593ec5ab1dc6223
MD5 hash: adfacdd460492ea04a2e94c3d38ac5b0
humanhash: colorado-twelve-yankee-dakota
File name:Payslip.rar
Download: download sample
File size:216'896 bytes
First seen:2020-08-05 12:19:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:mfIlRSO7QScI5R/b6wHzHBpAFbw9fQ7x4j3bI7x+efQx14Qoxz8V/oygUp9PxItm:rlIjScI5RGwTb9SyryrQx11oquRTEfI2
TLSH 39242388B89B61856B0199FFA0E78D81273D92EB37DDAC5F5940987054C7722F84B60B
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server0.ihswt.com
Sending IP: 142.11.236.209
From: "Per Te Corporation" <sales@ihswt.com>
Subject: Payment Advice
Attachment: Payslip.rar (contains "Payslip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14328960236fbf16dbee6e047a95f5a77eb9ba348466e3b488c80fc340e7aaae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:21:04 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cqzisybdn67rnw7onychvfpvu57ltoruqrtohneizah4gqhhvkxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/14328960236fbf16dbee6e047a95f5a77eb9ba348466e3b488c80fc340e7aaae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 14328960236fbf16dbee6e047a95f5a77eb9ba348466e3b488c80fc340e7aaae

(this sample)

Executable exe afe4edd3d00f95f9dbab6934ae1eb0a7354dc1f950182a27774ece0134a0166b

  
Dropping
MD5 5253700e5c012cb5ce9e4d2444904952
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 afe4edd3d00f95f9dbab6934ae1eb0a7354dc1f950182a27774ece0134a0166b

Comments