MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c81e3c2e59312601327df032e64abe6715c8a5097ab57807859e867688d3a273. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | c81e3c2e59312601327df032e64abe6715c8a5097ab57807859e867688d3a273 |
|---|---|
| SHA3-384 hash: | 481ebfbfadebd2332e7def23aa1aec58c2fb45213ec2b203d8e1f7b1f729345d66df65fd9d07ad7b064d79825afe72e9 |
| SHA1 hash: | 6010adb6e327133579ae83f38ae40c20ff8a4c70 |
| MD5 hash: | a6744b1b2b5337444752d964eb2af14b |
| humanhash: | minnesota-wisconsin-september-idaho |
| File name: | Merckgroup 214412.exe |
| Download: | download sample |
| File size: | 349'696 bytes |
| First seen: | 2020-11-18 12:32:37 UTC |
| Last seen: | 2020-11-18 14:49:15 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger) |
| ssdeep | 6144:JA4l07MF6/C9+24Lb7VtTSy9KLQidoWP2OfnDIlcQrEAmg+W8:Jfl07/CY2i3rOFFH6EAmD7 |
| Threatray | 94 similar samples on MalwareBazaar |
| TLSH | 83748EB4A1560565D65F0676ADAABE5001737E8BCCC6980C12BEB91337F3326BE52C0F |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: merckgroup.com
Sending IP: 45.88.3.248
From: Adityo Mulyo <adityo.mulyo@merckgroup.com>
Subject: Order 214412 (Purchase Order)
Attachment: Merckgroup 214412.img (contains "Merckgroup 214412.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Result
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Signature
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-11-18 12:33:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 84 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
spyware
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
8498a38721713177a5fb46cecd89d4dd24d962afb8ca4a4f369691daab0d44f9
MD5 hash:
94d5cd54f3331e84b5e3034537a890b9
SHA1 hash:
e12d1cb2700fe336e0ced439d87509b1b0c94ac1
SH256 hash:
d41def6638ed646301b48bbf82e71ed09a319c07df4f1e94ab81e05c7e48a19b
MD5 hash:
7de97c0ec390fae601dfa5628287ef32
SHA1 hash:
ea1f6a5521f96d07c8485dc56f4626c50dcddbca
SH256 hash:
c81e3c2e59312601327df032e64abe6715c8a5097ab57807859e867688d3a273
MD5 hash:
a6744b1b2b5337444752d964eb2af14b
SHA1 hash:
6010adb6e327133579ae83f38ae40c20ff8a4c70
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe c81e3c2e59312601327df032e64abe6715c8a5097ab57807859e867688d3a273
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.