MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324 |
|---|---|
| SHA3-384 hash: | 9bdb291e7abe50f58f66415403d13389a413f6e10fde1864bd523ce5f0c3661d66527efaed820e095a87b22c513f7e57 |
| SHA1 hash: | 7eede9bfe1ff75a32afe0c40e687e51d0a5483f3 |
| MD5 hash: | aad373fe494695bf75daa18df9ddf7ee |
| humanhash: | johnny-fix-hotel-friend |
| File name: | PURCHASE ORDER.exe |
| Download: | download sample |
| File size: | 3'927'552 bytes |
| First seen: | 2020-10-22 07:45:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 98304:6F6KiR1fmNThxarDr2LkZrjIOZJ6YFNUkvwt/T3:6C1fmNThxa3rzFvZNUk4tT |
| Threatray | 43 similar samples on MalwareBazaar |
| TLSH | 37062391FB59EEE5E1670FF010B9980993765E9DA062CA1D08BBF5BE69333C20057D0B |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: stock.ovh
Sending IP: 51.178.87.221
From: wilsonlee <wilsonlee@ogcf-eng.com>
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.rar (contains "PURCHASE ORDER.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Blocking the User Account Control
Enabling autorun by creating a file
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-22 03:30:28 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 33 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion trojan
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Checks whether UAC is enabled
UAC bypass
Unpacked files
SH256 hash:
f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324
MD5 hash:
aad373fe494695bf75daa18df9ddf7ee
SHA1 hash:
7eede9bfe1ff75a32afe0c40e687e51d0a5483f3
SH256 hash:
5fd31c6563ba4868adfbe8be3e29664913f88ccdccca89fc4b6e05a9d15d9e2d
MD5 hash:
25faa5b67e597b427aaaa177d2228921
SHA1 hash:
1dd06d14727f5708f8a811bc5b6d29e5739edf9e
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
SH256 hash:
825f4f7f883554c3d5beeaa3eec95142770093f90ee8f31e758b5f8df02da136
MD5 hash:
6a06b5565bc1a155c94a30beea8289e7
SHA1 hash:
c5f8e9398ebf59c08d1f9f2fef506c251bb20d29
SH256 hash:
03b33dc314e4e48df7f4268c06da860e4f9e2a6440d22c05a5ffe40b10b7b54e
MD5 hash:
e539377f7742afed7dcc4aa5cc4f1691
SHA1 hash:
ce34e5376247792e764b9e57fab51e4df6854997
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe f40a960ed96e9a20965c184a7f798a5c2510f5673fde3b2274e4ea7ab463a324
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.