MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2341d2eba9d6f7377bbc793e7a380a4d4f220c49cbe6326b6a91996d06c7607e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2341d2eba9d6f7377bbc793e7a380a4d4f220c49cbe6326b6a91996d06c7607e
SHA3-384 hash: af96453917e7b8312f6d90e833bab6d4e5db2211503ce32cda38233efa5c8c5290eb04c4a5d528502b98babd653e60d0
SHA1 hash: bf9f4b462d9e7f4af3e3f10b5d392fc9cafd59b9
MD5 hash: 37003022d13294405194772e315ffe16
humanhash: two-maryland-helium-spaghetti
File name:DOC BIDDING _RFQ FOR SHELL_TIMI DEVELOPMENT PROJECT SVI_03 INTERLOCK PACKAGE.IMG
Download: download sample
File size:1'245'184 bytes
First seen:2020-10-14 15:12:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:JT5p0P/E2iE+pcGgfzUfGxBhllqIzpRzjlXKqnoF/cH6qXL+:h0PYilrq4p4IzvjlaKhH6qC
TLSH A945AC0122849A12DC6F7B7E351EDE1017E1BC1F9B32D54DBF993F993EA3A8046A1712
Reporter abuse_ch
Tags:img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.atlasofset-tr.com
Sending IP: 188.225.18.183
From: Nurul Hidayah Imam <hidayah.imam@sapuraenergy.com>
Reply-To: Tay Tze Yen <ty_tay@sapuraenergy.com>
Subject: BIDDING - RFQ FOR SHELL - TIMI DEVELOPMENT PROJECT - VALVE INTERLOCK PACKAGE
Attachment: DOC BIDDING _RFQ FOR SHELL_TIMI DEVELOPMENT PROJECT SVI_03 INTERLOCK PACKAGE.IMG (contains "DOC BIDDING _RFQ FOR SHELL_TIMI DEVELOPMENT PROJECT SVI_03 INTERLOCK PACKAGE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42629.31722.21703.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2341d2eba9d6f7377bbc793e7a380a4d4f220c49cbe6326b6a91996d06c7607e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 00:58:52 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ena5f25j233to654pe7huoakjvhsedcjzptde23ksgmw2bwhmb7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2341d2eba9d6f7377bbc793e7a380a4d4f220c49cbe6326b6a91996d06c7607e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img 2341d2eba9d6f7377bbc793e7a380a4d4f220c49cbe6326b6a91996d06c7607e

(this sample)

Executable exe bfa8ca8a64dfbdd1b607b72848edc7ed107c90eb72b15c93d520392c201364fd

  
Dropping
MD5 0c42b0efe916ba20aeef66500c0c8521
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfa8ca8a64dfbdd1b607b72848edc7ed107c90eb72b15c93d520392c201364fd

Comments