MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 799a92c73f139faa4ed3b13076dc1b9b983d17d6d95eed284dd360c5920991ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

@abuse_ch

Malspam distributing unidentified malware:

HELO: static.224.7.21.65.clients.your-server.de
Sending IP: 65.21.7.224
From: Ms. Gusti Rudangga <adrjecb@widendeclaration.com>
Subject: Re: Quotation Request (RFQ)
Attachment: SKBM 0223.rar (contains "SKBM 0223.exe")

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

62

Origin country :

FR

Mail intelligence

Geo location:

Global

Volume:

Low

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Heur.31811.15540.UNOFFICIAL

Alert

Create hunting rule

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/799a92c73f139faa4ed3b13076dc1b9b983d17d6d95eed284dd360c5920991ca

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/799a92c73f139faa4ed3b13076dc1b9b983d17d6d95eed284dd360c5920991ca/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-02-23 07:24:33 UTC

AV detection:

7 of 47 (14.89%)

Threat level

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://www.spamhaus.org/query/hash/pgnjfrz7cop2utwtweyhnxa3tomd2f6w3fpo2kcn2nqmleqjshfa._file

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00