MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkTortilla


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64
SHA3-384 hash: 7c1807a60aaca5419b90248fa62bf40033e39d4a1deb4eb43de328859677cb54e069fd5306f8d5623b70186fe907ab4e
SHA1 hash: 9a33531d54088f8d2c850a0f6ebce13568707e9e
MD5 hash: 65ab04311976024c3cfc3792a31f4433
humanhash: uncle-solar-emma-jupiter
File name:INSD0004_RFQ_2024.IMG
Download: download sample
Signature DarkTortilla
Create hunting rule
File size:1'507'328 bytes
First seen:2024-01-22 07:06:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:z1s5KNvUy2MKnolTrpzFPWZK54gvF4zFor:zPNvUZMKnolTrpz54gvF4x
TLSH T1B165F13EB7C4BEDAE6392D768453290583F0C4E35B37F60B7CEC19E2AA256059A1F015
TrID 47.7% (.ISO/UDF) UDF disc image (2114500/1/6)
46.2% (.NULL) null bytes (2048000/1)
5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.1% (.ATN) Photoshop Action (5007/6/1)
0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Reporter cocaman
Tags:DarkTortilla img RFQ


Avatar
cocaman
Malicious email (T1566.001)
From: "orders@ampelos-oinologika.gr" (likely spoofed)
Received: "from d439192.name-servers.gr (d439192.name-servers.gr [116.202.131.181]) "
Date: "Sun, 21 Jan 2024 18:30:07 +0100"
Subject: "INSD0004 RFQ 2024-INFL"
Attachment: "INSD0004_RFQ_2024.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:INSD0004.EXE
File size:930'816 bytes
SHA256 hash: fe3182376591ab48521aa3c795de3f9bbfdc05559c525ea75f4125e011c9e656
MD5 hash: af4c57d9414400d9efebffe5a3ccbce3
MIME type:application/x-dosexec
Signature DarkTortilla
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.13916.15991.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Labled as:
Trojan/Generic
Link:
https://www.hybrid-analysis.com/sample/33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2024-01-21 11:13:01 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gp67lbfhygvzpylt7ehcg3bozjgnlw5txmm2vr2ei7dbvkigpjsa._file
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/33fdf584a7c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkTortilla

img 33fdf584a7c1ab97e173f90e236c2eca4cd5dbb3bb19aac74447c61aa9067a64

(this sample)

DarkTortilla

Executable exe fe3182376591ab48521aa3c795de3f9bbfdc05559c525ea75f4125e011c9e656

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe3182376591ab48521aa3c795de3f9bbfdc05559c525ea75f4125e011c9e656
  
Dropping
DarkTortilla
  
Dropping
MD5 af4c57d9414400d9efebffe5a3ccbce3

Comments