MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d3aab1f80e8d8025bbb38ca3ece961dd2e896041039f1bbdc1ee25996daab37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TaurusStealer


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d3aab1f80e8d8025bbb38ca3ece961dd2e896041039f1bbdc1ee25996daab37
SHA3-384 hash: ba804db5edd01d81c602ef081d56b59309aebd1dbdc9fe42cfe707fb10cdb11b3e8e2f39134638acfc3b2ade2915393e
SHA1 hash: 408cd4b0102d173a1581fef8db3ce8142c34834c
MD5 hash: 6e29693cfa077598b069297df14fa710
humanhash: october-jersey-snake-oven
File name:견적요청_아인테크_20210303.7z
Download: download sample
Signature TaurusStealer
Create hunting rule
File size:765'522 bytes
First seen:2021-03-03 07:31:53 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:Z1C/PsvS8A7RrD6y08S0XJqTjd3q2sDccl9DcS3VNJVDZtSklWik7H8hH1L:S/wS8ApRJrq1s4EL3ZjnlWj2HZ
TLSH 00F4332DC3F8EFB44A074FAB49192F928754F551023E3764ED52966860FB09AC311EBB
Reporter abuse_ch
Tags:7z geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm46.hanmail.net
Sending IP: 203.133.180.234
From: Ain Tech <dong4000@hanmail.net>
Subject: 견적요청_아인테크_20210303
Attachment: 견적요청_아인테크_20210303.7z (contains "po-202103.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.14556.29956.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d3aab1f80e8d8025bbb38ca3ece961dd2e896041039f1bbdc1ee25996daab37/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 07:32:08 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tu5kwh4a5dmaew53hdfd5tuwdxjorfqeca47do64d3rftfw2vm3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/9d3aab1f80e8d8025bbb38ca3ece961dd2e896041039f1bbdc1ee25996daab37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TaurusStealer

7z 9d3aab1f80e8d8025bbb38ca3ece961dd2e896041039f1bbdc1ee25996daab37

(this sample)

TaurusStealer

Executable exe 787760272209442be52c110ab48a8af7b6d504725708750685275ccdee2807ec

  
Dropping
MD5 83565d8eac8fbbc1b5392913e329397e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 787760272209442be52c110ab48a8af7b6d504725708750685275ccdee2807ec

Comments