MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892
SHA3-384 hash:	69ab7cf9e1cc55a2360e7d478744fbb62435266e3ebee3bc791f52c068eafac1907c2a7aa5d7fc8a8edd1065b55b74d9
SHA1 hash:	234591252b8d2327a8cbd9271750712184af2b87
MD5 hash:	56e9e57fca2e0c92de088cc891d01952
humanhash:	louisiana-nitrogen-sierra-oven
File name:	Ningbo-Overdue account.tar.001
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	858'624 bytes
First seen:	2023-12-15 10:48:04 UTC
Last seen:	Never
File type:	tar
MIME type:	application/x-tar
ssdeep	12288:760oLtG0CuvpMnb8KKeQ1dgC69SPZ1hUjMGLaIsVwLeKN/MsNP7r9r/+pppppppn:BgEcpMn8560PXKjMGLbSwLPN1q
TLSH	T1A405CE84EA4856A1CC6CABB15637CD3183237DAE6874E45C28DD3E6B3BFB7D25021463
TrID	62.9% (.TAR/GTAR) TAR - Tape ARchive (GNU) (17/3) 37.0% (.TAR) TAR - Tape ARchive (file) (10/3)
Reporter	cocaman
Tags:	001 AgentTesla DHL tar

cocaman

Malicious email (T1566.001)
From: ""kejia cai (DHL CN)" <5idhl_noreply@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [45.137.22.230]) "
Date: "15 Dec 2023 01:36:27 +0100"
Subject: "URGENT!!! Ningbo Overdue Account Letter"
Attachment: "Ningbo-Overdue account.tar.001"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

100

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Ningbo-Overdue account.exe
File size:	857'088 bytes
SHA256 hash:	969b81f3f2aeac2cde3b76b3b823b62f071775e89af47cc00ca8687ded8f38b9
MD5 hash:	f38babaecb1c7b00f67ded57fc4bf500
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.3057.6943.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed remcos

Link:

https://www.filescan.io/uploads/657c2f1e314dbc3b9b58697b/reports/f457bd7a-1461-40bb-996a-9ceb956c44dd/overview

Hybrid Analysis Mal/DrodTar

Verdict:

Malicious

Labled as:

Mal/DrodTar

Link:

https://www.hybrid-analysis.com/sample/f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

92%

Verdict:

Malware

File Type:

Archive

Link:

https://malprob.io/report/f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892/

ReversingLabs TitaniumCloud ByteCode-MSIL.Trojan.AgentTesla

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 05:10:28 UTC

File Type:

Binary (Archive)

Extracted files:

44

AV detection:

18 of 37 (48.65%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6txhujnzixkbaxbg2e7qh6tqqajnwqs2sbgxlpgixchogjmlrcja._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f4ee7a25b945d4105c26d13f03fa708012db425a904d75bcc8b88ee3258b8892