MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc09acfcf4f1a130df84aeaffdba32ab25a5f7952b44b24bc08f968ad4fd64c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc09acfcf4f1a130df84aeaffdba32ab25a5f7952b44b24bc08f968ad4fd64c3
SHA3-384 hash: c73bc39cda16a67bc84d8d366ddbdb8cb49849c979b45474ca9cb1b2eadf39dac111fa039a707f1019615e4ba8b9fac8
SHA1 hash: 1d9eab0a59f5387b698ba7ea7e2a45975fdcb775
MD5 hash: 7e06e91a0baabb0d257f9897b34349fd
humanhash: kilo-mars-lactose-texas
File name:Quotation_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:468'511 bytes
First seen:2020-06-01 10:36:47 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:Oyj6raCJr6yz7aPttAUI7U3JParje9xhbmpbP26H5/AMAJy0zg70KFKMpeDaIGTi:Yl16y/KOUZIjY0/AMAJDQb82A5
TLSH AAA4237CAE51ED3A8D05185608BE8FCF0A616840767D4DD2D6B308BBD7584ABE6370F8
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: CAO DUONG CO LTD <info.caoduong@caoduong.com>
Received: from mail.vinylbannersprinting.co.uk (mail.vinylbannersprinting.co.uk [217.174.249.10])
Date: Mon, 01 Jun 2020 10:06:09 +0100
Subject: REQUEST FOR QUOTATION!!
Attachment: Quotation_pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 09:49:46 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xqe2z7hu6gqtbx4ev2x73orsvms2l54vfncles6ar6livvh5mtbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz bc09acfcf4f1a130df84aeaffdba32ab25a5f7952b44b24bc08f968ad4fd64c3

(this sample)

AgentTesla

Executable exe 9bce611301f45b690f323467856374363983aa4c428c1e3cdb763f6e299bb419

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bce611301f45b690f323467856374363983aa4c428c1e3cdb763f6e299bb419
  
Dropping
AgentTesla

Comments