MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b74930ecd4ce99a8622154ddbf4a673bcad556b0b28046217d2f027473b93d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b74930ecd4ce99a8622154ddbf4a673bcad556b0b28046217d2f027473b93d9
SHA3-384 hash: 3bc2b7da2ed9e21a959c91aeba0e1cb408e8eda282cefd4ea39c80090836850bcdb3505191b8c90911e812f246729e4e
SHA1 hash: 11bdc558409e49a22d1d75773b9e71429876cb7d
MD5 hash: c0b0a75aa75b3f3e0dad127d83f76a97
humanhash: ack-apart-jig-ceiling
File name:payment notification.pdf.z
Download: download sample
File size:16'377 bytes
First seen:2020-10-13 12:27:04 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 384:o5AzCWKJDVXympc+lJeDzPhcmNXqc6PvPQwUu7ds14i+DL:o5HWUFymzIDzPhckXq9Pgw61r+/
TLSH 3772CFFCA5CCDEAF9E4627DF865CBDDE467B9B8701018B1F13991683982046042B788B
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: box.iizvar.com
Sending IP: 45.61.53.254
From: Paymentsemail@fnb.co.za
Subject: Payment Notification
Attachment: payment notification.pdf.z (contains "payment notification.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b74930ecd4ce99a8622154ddbf4a673bcad556b0b28046217d2f027473b93d9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 11:05:13 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dn2jgdwnjtuzvbrccvg5x5fgoo6k2vllbmuaiyqx2lycorz3spmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1b74930ecd4ce99a8622154ddbf4a673bcad556b0b28046217d2f027473b93d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

z 1b74930ecd4ce99a8622154ddbf4a673bcad556b0b28046217d2f027473b93d9

(this sample)

Executable exe 4e8319b60657f5cf0267967a37408e78f37569dea6fe24db2ddb49bb58cb9a04

  
Dropping
MD5 262a1ed87aae9a2d67e4e8ee77af0472
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e8319b60657f5cf0267967a37408e78f37569dea6fe24db2ddb49bb58cb9a04

Comments