MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc569a54d6f0df9773d2d0afb236c901fd7d313dabb5d335eac759fd302a10b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc569a54d6f0df9773d2d0afb236c901fd7d313dabb5d335eac759fd302a10b2
SHA3-384 hash: 3f9eee0fe1236d2c0a31ba15cdd3370d41910b1720099974cdfb784f844fbcf16adbcdc54cd2a1567340f87a891eb607
SHA1 hash: 0fd949e3ec79ea0283a0378899f2bfecc231d1cc
MD5 hash: 4de85ff9e9f63378d05b9ea3d34e82e2
humanhash: colorado-montana-lactose-delaware
File name:Purchase_order.rar
Download: download sample
File size:487'971 bytes
First seen:2022-06-14 10:05:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:99ldh20iks40FkN76rsbp8TrltRvxvT4aOMIF8w+DG9AHPTBjgt6d:9D20s4HNgsaTrlttx4FezH7BjgYd
TLSH T16DA4237FA3C331AE8E70CE0C5499315825D6806161E5A49BBF3E7DA4E739C60D99CACC
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Purchase Team<hmishra@gulbrandsen.com>" (likely spoofed)
Received: "from gulbrandsen.com (unknown [185.222.57.71]) "
Date: "14 Jun 2022 09:11:41 +0200"
Subject: "Purchase Order"
Attachment: "Purchase_order.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc569a54d6f0df9773d2d0afb236c901fd7d313dabb5d335eac759fd302a10b2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-14 04:04:33 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rljuvgw6dpzo46s2cx3enwjah6x2mj5vo25gnpky5m72mbkccza._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220614-l43pgahdc9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/dc569a54d6f0df9773d2d0afb236c901fd7d313dabb5d335eac759fd302a10b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar dc569a54d6f0df9773d2d0afb236c901fd7d313dabb5d335eac759fd302a10b2

(this sample)

Executable exe 56288de1614c45a260868392454f459af7f99d1d9b1d2d0aa07bb88c63412a19

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56288de1614c45a260868392454f459af7f99d1d9b1d2d0aa07bb88c63412a19

Comments