MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a621aa8cb4354aaf83d0300b38be8ab0a82a7fae97f34574377811448366af2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a621aa8cb4354aaf83d0300b38be8ab0a82a7fae97f34574377811448366af2
SHA3-384 hash: b34d28b5a4a851cb9a58f6bf281c5d92c2f13596f5b34003862ce22b0aa3fb3f446ace16c96ec64940e198336eafc711
SHA1 hash: ffe974130303073557828c70b7dc07dfacd27688
MD5 hash: e9397ba341cdeb788012ec61803a368b
humanhash: vermont-rugby-cardinal-five
File name:account confirmation,!.Z
Download: download sample
File size:414'870 bytes
First seen:2020-11-23 06:34:20 UTC
Last seen:2020-11-23 06:37:17 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:U5H04BdqtBA0hGHhoDz+5Y+u+gKOhduIFEugvlAMCoJUK+BdesaPE9icJ1NcJokq:vqHrKh+g/EuI2MXrLPuPNCEip+
TLSH FA9423D2B400B1D16990A1E50E793CE9917E0D06EBFCD1465E38862947AFD3B358BBEC
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "ACCOUNT<info@meherinternational.in>" (likely spoofed)
Received: "from meherinternational.in (unknown [92.118.190.190]) "
Date: "23 Nov 2020 05:01:55 +0100"
Subject: "Fwd: Urgent Attention: Payment Reconfirmation -EIM PAYMENTS"
Attachment: "account confirmation,!.Z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a621aa8cb4354aaf83d0300b38be8ab0a82a7fae97f34574377811448366af2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 06:35:05 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjrbvkglinkkv6b5amalhc7ivmfifj725f7tiv2do6arisbwnlza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a621aa8cb4354aaf83d0300b38be8ab0a82a7fae97f34574377811448366af2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

z 4a621aa8cb4354aaf83d0300b38be8ab0a82a7fae97f34574377811448366af2

(this sample)

Executable exe ce9705bcf9a38d9e6cf1218fd82ec8c2617af242c2ede759327d50b00d8151c5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce9705bcf9a38d9e6cf1218fd82ec8c2617af242c2ede759327d50b00d8151c5

Comments