MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a78e3e09498b7cc5c1f1e5befeb9b138dfbd8f278a8b983897762ed25541f7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a78e3e09498b7cc5c1f1e5befeb9b138dfbd8f278a8b983897762ed25541f7c
SHA3-384 hash: f79a0892b4330b6abda8b1e847d341db495129d4ae00e619d14e5db901e2fd27ebf23ebaaa09f68a705b6a9d46989ec4
SHA1 hash: 35697f4e528805a84a8100d6e7dd95479ed6ffb8
MD5 hash: 3e71758e0af3bb4bab2e26d476aab0c6
humanhash: iowa-mike-queen-india
File name:New Order - IC Project.zip
Download: download sample
File size:519'106 bytes
First seen:2020-10-06 06:13:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GsL7g8izBjz1rm2Q6rs5iVu8qYosMjc5nBwP0VjmA9toBJC:GR9zvrm2pQguKos0cVyA90C
TLSH F8B423E5E8758F106C41ECA11EDA937F2DB027CE64E71748F2C8D6AEC0489D3CA2E595
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lk-tech.com
Sending IP: 103.141.138.124
From: tuong.nb@lk-tech.com
Subject: New Order - IC Project
Attachment: New Order - IC Project.zip (contains "New Order - IC Project.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a78e3e09498b7cc5c1f1e5befeb9b138dfbd8f278a8b983897762ed25541f7c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 03:37:32 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nj4ohyeutc34yxa7dzn67243cog7xwhspculta4jo5ro2jkud56a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a78e3e09498b7cc5c1f1e5befeb9b138dfbd8f278a8b983897762ed25541f7c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 6a78e3e09498b7cc5c1f1e5befeb9b138dfbd8f278a8b983897762ed25541f7c

(this sample)

Executable exe 2408f4144f6b51601965eef8aaf6d78400e34e6599e59801dc6b5e48d385a077

  
Dropping
MD5 4b805a5545f681a0d5d367c3c9010aaf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2408f4144f6b51601965eef8aaf6d78400e34e6599e59801dc6b5e48d385a077

Comments