MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d0f17f641e6d00d16f68ef3ecdde1a2aaab8742ba9d583be97e295613b692da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d0f17f641e6d00d16f68ef3ecdde1a2aaab8742ba9d583be97e295613b692da
SHA3-384 hash: 71753fee111194819d1db070ae5e262d6ed996b0e5a5c72a14329f29d9f636f754a547d58b665d25314c66ac1a48cf39
SHA1 hash: 623be66e4d1d405b07edbe2f327f543e3628ea33
MD5 hash: 9428bf822f554dd34ed4e51839053459
humanhash: wolfram-violet-magnesium-angel
File name:PURCHASE ORDER.rar
Download: download sample
File size:3'739'113 bytes
First seen:2020-10-22 07:45:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 98304:NCKsAvm9th185n1+AQlEgtsTPfK8xzGC9WQ7d+QvioN3/AUOVA/uW:NCnAU1WwlEgeTnKOzGW3iEoU/j
TLSH 7A0633B3DD4A5A36BCC081464D9EDF0403F54B9C2B6BFA3915BF4AB1D8F607227846A4
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: stock.ovh
Sending IP: 51.178.87.221
From: wilsonlee <wilsonlee@ogcf-eng.com>
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.rar (contains "PURCHASE ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d0f17f641e6d00d16f68ef3ecdde1a2aaab8742ba9d583be97e295613b692da/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 03:30:24 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nuhrp5sb43ia2fxwr3z6zxpbukvkxb2cxkovqo7jpyuvme5wslna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 6d0f17f641e6d00d16f68ef3ecdde1a2aaab8742ba9d583be97e295613b692da

(this sample)

Executable exe f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324

  
Dropping
MD5 aad373fe494695bf75daa18df9ddf7ee
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324

Comments