MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 974d2391a4d887922f71fcdceed19918b217f6496d3f76157de533fc281baca1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 974d2391a4d887922f71fcdceed19918b217f6496d3f76157de533fc281baca1
SHA3-384 hash: 050e8460be34c39ed320850b0bc6bf9111b1382ced39017c3036b7d37f050c8f4e41c5a61de92945842ee254e6e78f77
SHA1 hash: 971977b1512ba3f96bc84cb427b59b4be9d6e752
MD5 hash: dd604e9db8a3721d87b520b0a0593321
humanhash: alabama-saturn-comet-jersey
File name:maersk courier document.exe
Download: download sample
File size:1'227'776 bytes
First seen:2022-02-28 08:11:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 24576:Rp9NVf7bppxgr2R53Yifh7Y+qMYHm/x+94JQ:ZPf7bppWr++67jx5+cQ
Threatray 1'585 similar samples on MalwareBazaar
TLSH T10245BF402BABD0CCF2A26EBE6DC4A5F08BD9ED362D0DB1B534903F5607B1D92D991235
Reporter abuse_ch
Tags:exe Maersk

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245204/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe update.exe
Link:
https://www.filescan.io/uploads/621c83d7b94fb38cb4227e4c/reports/bfd05ede-7889-42e3-88b1-9cc93507dadc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
63 / 100
Link:
https://www.joesandbox.com/analysis/947191
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 579670 Sample: maersk courier document.exe Startdate: 28/02/2022 Architecture: WINDOWS Score: 63 14 Antivirus detection for URL or domain 2->14 16 Multi AV Scanner detection for submitted file 2->16 18 Yara detected AntiVM3 2->18 20 5 other signatures 2->20 7 maersk courier document.exe 3 2->7         started        process3 signatures4 22 Adds a directory exclusion to Windows Defender 7->22 10 powershell.exe 23 7->10         started        process5 process6 12 conhost.exe 10->12         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/974d2391a4d887922f71fcdceed19918b217f6496d3f76157de533fc281baca1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-28 08:12:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5gshene3cdzel3r7too5umzdczbp5sjnu7xmfl54uz7yka3vsqq._file
Verdict:
malicious
Similar samples:
0e0881351587adaa5a1b7361fdc03167ef38d9e7db2e55110e97c5a2644de94b
6b66b5b7d5ce4613a9ecd178cce2f5cd8e745ba489f75bdf02c8224703679802
9b32c7bab515a968de59b05494701600fb0fac369e11169297713dc30b552491
a51857a171edb674895ee6ec8813aa5b3701c223b613f17d23b0fd01967be01a
c3e4c2e1e242cf92142f4d4fb1896354cfa07089f40243b31046ff3eae8ac2c8
dfd1a15b039b2d2769b3e8ef711caa33b1fbc58a75da4c734517b2001a506ca0
fab057e449135e0e01df2fec5179835247a71d82cbd04cbca8ae2087d2f6a339
+ 1'575 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220228-j3vlcsdfh3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Unpacked files
SH256 hash:
c1f9ef16f29f4a7c544b7b435f15bd3444f61f5490c41f16393a7bbeb3e3dd24
MD5 hash:
baa68d9c211495569274dc227012d268
SHA1 hash:
cb3c4fe87ae515af7e9a823ee8988ad9424384b0
Link:
https://www.unpac.me/results/9152df80-4df4-4ee9-b805-70e2ea2c1fde/
SH256 hash:
393b2d75ed0c7cd97514c670c7eb39d15348b3e4cb9a43afdd3a589707906a98
MD5 hash:
c670df788ccb706c24503445aa8ea0b0
SHA1 hash:
cadd286f6d1911b8117c2d23149550c5b76c4a72
Link:
https://www.unpac.me/results/9152df80-4df4-4ee9-b805-70e2ea2c1fde/
SH256 hash:
ffa0e1ea8b5153a88880707e884eae71bfad46df1dcbd39e16ce7c8c89ee5990
MD5 hash:
f73a95b11cbb1ce13eb73292ee445528
SHA1 hash:
7f70f11bdd9746f5c1cc2354621aeae9a7c80192
Link:
https://www.unpac.me/results/9152df80-4df4-4ee9-b805-70e2ea2c1fde/
SH256 hash:
e3bdaf9e98eb65a070cf4424bc123e57ade151c41e4a0d375e769749155c1715
MD5 hash:
78a25e75b94923e889ecd100349facbe
SHA1 hash:
6b3f8db525d3c98f92ed480e664ab8ee9458340b
Link:
https://www.unpac.me/results/9152df80-4df4-4ee9-b805-70e2ea2c1fde/
SH256 hash:
974d2391a4d887922f71fcdceed19918b217f6496d3f76157de533fc281baca1
MD5 hash:
dd604e9db8a3721d87b520b0a0593321
SHA1 hash:
971977b1512ba3f96bc84cb427b59b4be9d6e752
Link:
https://www.unpac.me/results/9152df80-4df4-4ee9-b805-70e2ea2c1fde/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/974d2391a4d887922f71fcdceed19918b217f6496d3f76157de533fc281baca1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245204/

Comments