MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7fb829997c51d2830c52490732946d728520f1842cf2a02342ec0d8404cd52ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 7fb829997c51d2830c52490732946d728520f1842cf2a02342ec0d8404cd52ae |
|---|---|
| SHA3-384 hash: | 2763449611d4c62a97622c9cd0544255e3eb50357c7dcf92359a40873f3c0c38ccd36ab502fc633b35eac79f6775a1fc |
| SHA1 hash: | 608a5286fd6377a2108125da45bfa0dfd8fda3cf |
| MD5 hash: | 411c550880bd9cc81e3ff7b199699515 |
| humanhash: | asparagus-oven-mississippi-batman |
| File name: | Westpac_Transfer_Receipt.img.exe |
| Download: | download sample |
| File size: | 763'904 bytes |
| First seen: | 2020-10-07 05:03:27 UTC |
| Last seen: | 2020-10-07 06:24:29 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 12288:8SivlLBiLXKOkkscfoh/0oxeVdVgY1afKzWlPT4khu:8hLfkscQCDg+EKzWtUkh |
| Threatray | 164 similar samples on MalwareBazaar |
| TLSH | 95F49DB368C2549DCD6A4A715CB580E0F97632CE3F938A0FB19E430C0E15E57B76A25E |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: mail.cswebservice.de
Sending IP: 46.252.24.25
From: Westpac Bank Australia <elizabward@westpac.com.au>
Reply-To: elizabward.westpac@mail.com
Subject: Your payment swift copy
Attachment: Westpac_Transfer_Receipt.img (contains "Westpac_Transfer_Receipt.img.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Creating a file in the %AppData% subdirectories
Launching a process
Creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
.NET source code contains very large array initializations
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-06 23:58:36 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 154 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Loads dropped DLL
Unpacked files
SH256 hash:
7fb829997c51d2830c52490732946d728520f1842cf2a02342ec0d8404cd52ae
MD5 hash:
411c550880bd9cc81e3ff7b199699515
SHA1 hash:
608a5286fd6377a2108125da45bfa0dfd8fda3cf
SH256 hash:
9e711e7d6d9a8f0cb54f0c83eb74ad7cb09f33310996cc7ad85f49907d65f0a3
MD5 hash:
d5b54f0f0fe63d9d0a9d2d608e158c6a
SHA1 hash:
52cab4fc7e5aac5f9784affd348a3f87afe498c7
SH256 hash:
06c31e4c38350cafcacfa844d02277f7ea265c0d800f6dbe7f9eb935ed1305f1
MD5 hash:
27bbc74d38f1102f6f25815ac7e62c9f
SHA1 hash:
8b54b73db2549e2a5c81d1621f9e4ca53bb80b4c
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
f8bee4108a324df32ad5a2ebafa6b7f411402a21e2598cf9db66486970f80fdd
MD5 hash:
a92da98ff6f5ae608503d074617bcc2a
SHA1 hash:
d3eafcccca011bb3a7a5ae52dd9704ceafcde472
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 7fb829997c51d2830c52490732946d728520f1842cf2a02342ec0d8404cd52ae
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.