MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41c8f6068a2af552f4ab9edd254217b79983f3416205d8bc6e3397c8ffcd043d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41c8f6068a2af552f4ab9edd254217b79983f3416205d8bc6e3397c8ffcd043d
SHA3-384 hash: c1384c2ad2d5cc45aefda436a94a8dcaad8c2e629b5703c334c09d6f96159bc3319164fb40ba6878ff95226131606a20
SHA1 hash: 1b669963c29f5d6d764b804e73088f2635ae09d9
MD5 hash: 9511fbf0e7e9012c4e00b1fe68c106f0
humanhash: low-tennessee-papa-arkansas
File name:Payment Advice GLV225445686.r00
Download: download sample
Signature HawkEye
Create hunting rule
File size:691'731 bytes
First seen:2021-02-25 19:55:12 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:2by2kYiCIjnM9t7BpCzG4aIOdVT96EHOQUAhluBY+C1MFYhw8:2bv1mM9NSRjOgkj3uBpCvr
TLSH 75E423D2C144500A09FA54D292EB26C837E516E1F574AEBF33E7D3E4C4ADA9AC0F2935
Reporter cocaman
Tags:HawkEye HSBC r00


Avatar
cocaman
Malicious email (T1566.001)
From: ""HSBC Advising Service" <Ajith.Bandara@drsulaimanalhabib.com>" (likely spoofed)
Received: "from drsulaimanalhabib.com (unknown [45.137.22.101]) "
Date: "25 Feb 2021 11:07:22 -0800"
Subject: "Payment Advice - Advice Ref:[GLV225445686] / ACH credits / Customer Ref:[SUPPYT] / Second Party Ref:[20210221]"
Attachment: "Payment Advice GLV225445686.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41c8f6068a2af552f4ab9edd254217b79983f3416205d8bc6e3397c8ffcd043d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 10:22:23 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihepmbukfl2vf5flt3oskqqxw6myh42bmic5rpdogol4r76naq6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

r00 41c8f6068a2af552f4ab9edd254217b79983f3416205d8bc6e3397c8ffcd043d

(this sample)

HawkEye

Executable exe 9c3da492d0b98fec833d5217e46cee71fd67cf4d0bae48267cc4007095f096d2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c3da492d0b98fec833d5217e46cee71fd67cf4d0bae48267cc4007095f096d2
  
Dropping
HawkEye

Comments