MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07981354aad310028a2e5d4bff50a729143af433b99e6c629e4ec15353b9364b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07981354aad310028a2e5d4bff50a729143af433b99e6c629e4ec15353b9364b
SHA3-384 hash: a8aacb5d1060e7d4e65f79f57e978173e8a59c404afb25567e4559257ffb6dd7f7cdb7150381d5930a20533b73455a4e
SHA1 hash: 39b3dbedfb390cc56152ffa6d3244e9f4a9d85d7
MD5 hash: aaed6896fff554210ceff424d2a7c023
humanhash: princess-moon-saturn-stream
File name:Customer Order, Images, Spec.zip
Download: download sample
File size:865'195 bytes
First seen:2020-12-17 06:55:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:sGtH8EGIaPRAEtSHU1dMKrzaSKzv7gV7E4AiFFQ3g27:sg8WaPDtCU1O5vgVhFFQQE
TLSH 290533BC7BEF65490FF2C641A92A9DB8692E88F535671F774F901F84A860090311F2F9
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Gupta <intetsvar@regionh.dk>" (likely spoofed)
Received: "from regionh.dk (unknown [23.106.223.74]) "
Date: "16 Dec 2020 21:10:41 -0800"
Subject: "Price Request"
Attachment: "Customer Order, Images, Spec.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.474.24130.23430.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07981354aad310028a2e5d4bff50a729143af433b99e6c629e4ec15353b9364b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 05:45:23 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6mbgvfk2miafcrolvf76ufhfekdv5btxgpgyyu6j3avgu5zgzfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07981354aad310028a2e5d4bff50a729143af433b99e6c629e4ec15353b9364b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 07981354aad310028a2e5d4bff50a729143af433b99e6c629e4ec15353b9364b

(this sample)

Executable exe 242045c07ffb6427b046939045d9312f3beaa954ef3ec60316247f7dfdfbca3e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 242045c07ffb6427b046939045d9312f3beaa954ef3ec60316247f7dfdfbca3e

Comments