MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e7093701af6b3274e0bb65f1c42640f00ebff8d866f5818c59f6eb6f8bf9e14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e7093701af6b3274e0bb65f1c42640f00ebff8d866f5818c59f6eb6f8bf9e14
SHA3-384 hash: 812902d933e6c30ae20108800a78e71f20969a282c3a54689e9b4fd3e79448bfaf00e34f966ece10433279d1d381047c
SHA1 hash: 49ff0cdac0726c260744ed79b8eca1944f61f168
MD5 hash: 4892b6200a846ce09e7f89fd3174eced
humanhash: stream-network-december-freddie
File name:PO2021-03-03.pdf.gz
Download: download sample
File size:6'109 bytes
First seen:2021-03-03 07:32:09 UTC
Last seen:2021-03-03 14:21:27 UTC
File type: gz
MIME type:application/x-rar
ssdeep 96:PQFF++oCBlyL19KChat/Tu59LBNjbhRixBUqWx2SWAKpftFbvfJiABt1C:I3Z7yb4t/GL/bPi3UJx2SItFbvfdvC
TLSH BAC19EE584F1A93672015CE7EA239314C9424221DFCBE9A22FE7F931647D42F1F5409B
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tpcdel.com
Sending IP: 103.99.1.170
From: Sally Thung <ecom8@tpcdel.com>
Subject: RE: New orders by SEA FO2012002.
Attachment: PO2021-03-03.pdf.gz (contains "PO2021-03-03.pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e7093701af6b3274e0bb65f1c42640f00ebff8d866f5818c59f6eb6f8bf9e14/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:33:13 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzyjg4a262zsotqlwzpryqteb4aox74nqzxvqggft5xln6f7tyka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/3e7093701af6b3274e0bb65f1c42640f00ebff8d866f5818c59f6eb6f8bf9e14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

gz 3e7093701af6b3274e0bb65f1c42640f00ebff8d866f5818c59f6eb6f8bf9e14

(this sample)

Executable exe a510e53b9d4890169698ec59c0fc2ad559f1cc476a35b199b01a07827bd29899

  
Dropping
MD5 55820ab531d8e37481453f30cfeccaac
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a510e53b9d4890169698ec59c0fc2ad559f1cc476a35b199b01a07827bd29899

Comments