MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5d3293bb885009c8f6691eb9a45d4c7f6c4869f5e4f0f196dc519bb9f39472b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5d3293bb885009c8f6691eb9a45d4c7f6c4869f5e4f0f196dc519bb9f39472b
SHA3-384 hash: 8bd9c6eef6d23e1623f95590a5c46de4db4b78a0f66b6eb1b185aefb2334e05cf0fde21770328a80e097b7e26ad0083d
SHA1 hash: 2a502329ae11fcf863142f33bc209ccff08716c0
MD5 hash: 2ed8e27a8d936e6b27f3b0854df533d9
humanhash: maryland-hotel-connecticut-saturn
File name:REQUEST FOR QUOTATION.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:660'583 bytes
First seen:2020-08-04 13:17:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CpJHmw4fTisZQ0rz9FjNRtKwNFPyag0Lb0sERRN1ZTWhe3oTfo6HdF:oJHT42OVxJNRYKPyageARbTWheYTj9F
TLSH EFE423D48A48C8285F7DF0B51ABBA95C51CB07677AB880750CD3AE8634F4AD1D8CD16F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Ikram Muhamad <mw.ikram@toyo-eng.com>
Reply-To: mw.ikram@toyo-eng.com
Subject: RFQ TOYO ENGINEERING [PR742 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd
Attachment: REQUEST FOR QUOTATION.rar (contains "REQUEST FOR QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5d3293bb885009c8f6691eb9a45d4c7f6c4869f5e4f0f196dc519bb9f39472b/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:19:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xjsso5yquajzd3gshvzurouy73mjbu7lzhq6glnyum3xhzzi4vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e5d3293bb885009c8f6691eb9a45d4c7f6c4869f5e4f0f196dc519bb9f39472b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e5d3293bb885009c8f6691eb9a45d4c7f6c4869f5e4f0f196dc519bb9f39472b

(this sample)

AgentTesla

Executable exe fb42ce632ff111ef24eebae3f336e0e04b8602dd621e2886a22ce0870ce287c4

  
Dropping
MD5 380dccf3e217737abd694fb7ae9221e9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fb42ce632ff111ef24eebae3f336e0e04b8602dd621e2886a22ce0870ce287c4

Comments