MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 41b9d0244f4f20ce8ca891119deb82379605825206dc567bb42b7a8989db639f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 41b9d0244f4f20ce8ca891119deb82379605825206dc567bb42b7a8989db639f |
|---|---|
| SHA3-384 hash: | 240271e38c60b4c795794f9bb9e6f162f6696960ecec37c20d30faa5c51fbbe3d58772a91effc93123f7483d460f1715 |
| SHA1 hash: | 3d75e132b2172d2f07f8cb958590fe68aa1e1f63 |
| MD5 hash: | 31e204735f51f6ceff3e82f962977873 |
| humanhash: | twelve-island-purple-seven |
| File name: | FedEx invoice_AWB102235516763.exe |
| Download: | download sample |
| File size: | 458'240 bytes |
| First seen: | 2020-11-23 06:36:47 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:HUt8LFv1bIB9L8xnhuLyfGXBHds8S0bGKRB+:Ho89a8xnh6XHtf+ |
| Threatray | 2 similar samples on MalwareBazaar |
| TLSH | 82A412724183AF92CB9E5EB0E19133441EB5AD1BE220DF2DBF9C028932A1B5DDD51E71 |
| Reporter |  cocaman |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching a process
Result
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
.NET source code contains potential unpacker
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-11-23 04:23:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
41b9d0244f4f20ce8ca891119deb82379605825206dc567bb42b7a8989db639f
MD5 hash:
31e204735f51f6ceff3e82f962977873
SHA1 hash:
3d75e132b2172d2f07f8cb958590fe68aa1e1f63
SH256 hash:
66a4ae68704329a20e6bae043835a844ab77e4c797d382a7032d17af00330e98
MD5 hash:
e021e2b8b3fb78faa8b3d04e82d5267d
SHA1 hash:
8d53cab19faace3f2c652f002b6b6ec586b4b784
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 41b9d0244f4f20ce8ca891119deb82379605825206dc567bb42b7a8989db639f
(this sample)
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.