MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5
SHA3-384 hash:	dc80a1a1f5a27afc7006c8b6a505a10a04fa25f855c53c62d45175fbbfc5b4fe35a05c6d6e0fa1d4dd86367720a6b78d
SHA1 hash:	95405cc20ada1f8a707b4effcc479599fcc63280
MD5 hash:	1d3d0f08ac90914067c6cc0b7693de5b
humanhash:	may-october-pasta-friend
File name:	Harbur Statement.rar
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	634'020 bytes
First seen:	2023-12-15 09:12:09 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:tkHav/M9Zj6BomyqDf02WxwELq5m+OS88Hv1j/4RZyx:KHav/M9Zj6Zy/Lz+VFHvt/4Rg
TLSH	T10DD4230EF29B21D6C83DD670D42A4B434535F1AE187B15AFD622572A7BAE30BD97030E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla rar

cocaman

Malicious email (T1566.001)
From: ""kato"<kato@covac.co.jp>" (likely spoofed)
Received: "from covac.co.jp (unknown [91.92.243.208]) "
Date: "14 Dec 2023 03:54:36 -0800"
Subject: "Harbur Statement"
Attachment: "Harbur Statement.rar"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Harbur Statement.exe
File size:	657'408 bytes
SHA256 hash:	26e3295aa8a473155951d618971b749be570e36898bb7ad0b0e690648e7c2fd8
MD5 hash:	ba1734b5124bfa8c0272693c04b1469e
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

DocGuard Unknown

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5/results/dashboard

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade packed

Link:

https://www.filescan.io/uploads/657c189fb290743934e5b4cd/reports/67273b33-956f-4c9f-ae2c-43893087db5d/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-14 04:01:20 UTC

File Type:

Binary (Archive)

Extracted files:

8

AV detection:

21 of 37 (56.76%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yiamjiyay6dggkzbydy3hfhqjvlkycqutxfx2ywwvcxaejavk3sq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c200c4a300c786632b21c0f1b394f04d56ac0a149dcb7d62d6a8ae02241556e5