MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b28871ecbe806fa4c37704feae2e34a6321cf535e4b049176da964f2f2b056ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	b28871ecbe806fa4c37704feae2e34a6321cf535e4b049176da964f2f2b056ff
SHA3-384 hash:	c5b229a35f7afd65f0e99abeebca0e841f139d5cfb3a2cf730cf8daa5334475e4071272904ce8eb7baf175d4835960ec
SHA1 hash:	d9c1aa2baa852db4485389a000f473f2ccf4d11c
MD5 hash:	c54d729667869dda1ab106fd90bbfd72
humanhash:	gee-helium-two-river
File name:	RFQ#1952022(BOQ-IT-Equipment.pdf.lz
Download:	download sample
File size:	1'670'776 bytes
First seen:	2022-05-04 15:33:25 UTC
Last seen:	2022-05-05 06:15:58 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:olmoaT+dQUKK5m+NGkQWSO4qIbfjJOdTrgVIaIqq7kOo4+vQ+JsVsHxpQwjlGqpY:E3WIKELNGkodf9IgO7kOMZmVs/LlRgPD
TLSH	T13C7533FEE16E1E4F3D4DC450E8506F25B2F19A6AE4B6E491C13E63F82E9122D720F485
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	lz rar RFQ

cocaman

Malicious email (T1566.001)
From: "JENNIBETH MAGNO <jennibeth@atginteriors.com>" (likely spoofed)
Received: "from atginteriors.com (unknown [45.137.22.114]) "
Date: "04 May 2022 21:46:22 +0200"
Subject: "HP RFQ 4.5.2022"
Attachment: "RFQ#1952022(BOQ-IT-Equipment.pdf.lz"

Intelligence

File Origin

# of uploads :

# of downloads :

211

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

fareit obfuscated packed

Link:

https://www.filescan.io/uploads/62729cc962b1ae4451d6a482/reports/f03de635-e3df-4f64-99ee-2d811168bdb9/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b28871ecbe806fa4c37704feae2e34a6321cf535e4b049176da964f2f2b056ff/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-05-04 09:17:13 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 26 (61.54%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wkehd3f6qbx2jq3xat7k4lruuyzbz5jv4syesf3nvfspf4vqk37q._file

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/220504-szrjzaghem/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Drops file in Windows directory

Drops autorun.inf file

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Drops startup file

Loads dropped DLL

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.54

Link:

https://yomi.yoroi.company/submissions/b28871ecbe806fa4c37704feae2e34a6321cf535e4b049176da964f2f2b056ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research