MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b
SHA3-384 hash: 13c6d04f28ffcec92a23b90008f808e8cc4938c7f960ac165a2def907075f58ec97c1c23d2fc4275387c53068144aaab
SHA1 hash: 60379f5dc5147ffd14c0a3dc9288508bcf61aebb
MD5 hash: fc12df534d811b1795367d0ae29f03ff
humanhash: mars-alanine-one-spring
File name:Reconfirm payment_details.rar
Download: download sample
File size:401'306 bytes
First seen:2021-11-26 07:06:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:qJWYWxF7hqlVXh8OlyZzMH40qae5etp66UnF2eMW1JOk6mIOIrPiJQIWjjF2Oftm:qJneSBl2z3BeD66UnFhbfFIzfjFdftm
TLSH T1F184230C3E40DFC92B75E49F915C9AE19D478C81C1C826A9FF72686FEE11F42927AD20
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""International Contracting Company" <sales@icmaster.com.hk>" (likely spoofed)
Received: "from icmaster.com.hk (unknown [185.222.57.237]) "
Date: "26 Nov 2021 03:03:54 +0100"
Subject: "Reconfirm payment Information"
Attachment: "Reconfirm payment_details.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed strictor
Link:
https://www.filescan.io/uploads/61a08798b71ceed415313593/reports/d5d2f5c4-38a8-4fab-9161-e70cb2bda008/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-26 07:07:12 UTC
File Type:
Binary (Archive)
Extracted files:
36
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5jng6lm6emomq5xirby6ol5hjbsdzcpnp4q34vwtzwo4765qfnq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/211126-hxm4naecd2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b

(this sample)

Executable exe 88eaf54c0f1a272c07bc32b802bfe1c57a9fed0ad722ae7b55095df169ca4176

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 88eaf54c0f1a272c07bc32b802bfe1c57a9fed0ad722ae7b55095df169ca4176

Comments