MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c169469e2e32039ff3830a8e17bad2444a876e96935b6d925cb2d07353c804c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | c169469e2e32039ff3830a8e17bad2444a876e96935b6d925cb2d07353c804c5 |
|---|---|
| SHA3-384 hash: | 3b34592c68249d39ff2869ff357014e68881c9b4636fc03f48f494ff9328ce9b14181f5bba950a3c0a0b3357e541c7e1 |
| SHA1 hash: | a8f6df23fdf8d509257b06791f0a9fc6a05c205c |
| MD5 hash: | b26cdef5f715b872df099b0184dc004d |
| humanhash: | virginia-south-alanine-blossom |
| File name: | Payment_Invoice.exe |
| Download: | download sample |
| File size: | 962'560 bytes |
| First seen: | 2020-10-19 09:54:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 24576:XIbrd6IWOo+A2K4+pvPGC7MWyRs8mMmB/BdyxyBw5:XOWD+nK4OPGC7MrRs8m3Twx+w |
| Threatray | 18 similar samples on MalwareBazaar |
| TLSH | 2E25230CF64E8373D62DAA7C625E8D452EB999067051F28F8EDD51ED0547F889C2C0EB |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: dd48220.kasserver.com
Sending IP: 85.13.164.135
From: Quality Engineering Products <christiane.helf-marx@akadia-akademie.de>
Reply-To: snambrath.almandoos@bk.ru
Subject: Re: Payments - October Invoices
Attachment: Payment_Invoice.zip (contains "Payment_Invoice.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-19 05:08:54 UTC
AV detection:
17 of 26 (65.38%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
c169469e2e32039ff3830a8e17bad2444a876e96935b6d925cb2d07353c804c5
MD5 hash:
b26cdef5f715b872df099b0184dc004d
SHA1 hash:
a8f6df23fdf8d509257b06791f0a9fc6a05c205c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe c169469e2e32039ff3830a8e17bad2444a876e96935b6d925cb2d07353c804c5
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.