MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fe89ab4a489b6fc0fbc4f1964b610007e7ee580793cdcb7ce3ab5cdbe10652d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fe89ab4a489b6fc0fbc4f1964b610007e7ee580793cdcb7ce3ab5cdbe10652d
SHA3-384 hash: 7f28ee18e8ac9d0f6bb25c60833cf114c329f8f00f620f6e32db11569b02432809c1c48c2b4cc54c3bbcc967bc68af26
SHA1 hash: e17ec4e08f9f07057c2659e51c6178df60e468c7
MD5 hash: b3cded8b316eb4bde3d35d631a1c6148
humanhash: video-coffee-football-jig
File name:PL, INV & BL_DOCUMENTS.IMG
Download: download sample
File size:1'245'184 bytes
First seen:2020-06-30 07:15:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:GWNsJgz/NoWUcxzhSlGpmHteOrSJOfgrxTV02Mdbs:G+y4VVtJS4MeESJRTXMdo
TLSH 2C45129ECBC00AF2E458657701A39D254284E0627A5EAB433F1E9C0CFF356D79AB4E71
Reporter cocaman
Tags:img


Avatar
cocaman
Malicious email
From: DHL Service <uxys@dassd.co.uk>
Received: from box.dassd.co.uk (box.dassd.co.uk [104.168.171.121])
Date: Tue, 30 Jun 2020 07:09:44 +0100
Subject: RE: DHL ARRIVAL SHIPMENT PRE-ALERT FOR HCL :CPWMANR2015726 //
CONTAINER NO: MAY0118243 //1X40HC

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fe89ab4a489b6fc0fbc4f1964b610007e7ee580793cdcb7ce3ab5cdbe10652d/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 07:17:04 UTC
File Type:
Binary (Archive)
Extracted files:
73
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7ujvnferg3pyd54j4mwjnqqab7h5zmape6nzn6ohk243pqqmuwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img 4fe89ab4a489b6fc0fbc4f1964b610007e7ee580793cdcb7ce3ab5cdbe10652d

(this sample)

AgentTesla

Executable exe 6a22f447f1f33ab89c601e610999524ccb6d764361d3bdadaedd2c3b8d6b7184

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a22f447f1f33ab89c601e610999524ccb6d764361d3bdadaedd2c3b8d6b7184

Comments