MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 File information Yara Comments
Add tag Delete this sample Report a False Positive

SHA256 hash: ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39
SHA3-384 hash: d7e50fbe22c14822258b36c7bb6d4983d3e20d5335fdae728fea8b2dd60cb3549886ed537bdcf40d84fd3f8a2f66ecdd
SHA1 hash: ae06c4ce12b656be056cc366b4661cd84b19d674
MD5 hash: 677f7c3940ef835ff36bb7ac948bf805
humanhash: fruit-august-finch-hotel
File name:RFQ pdf.tar.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'000 bytes
First seen:2021-02-23 06:38:31 UTC
Last seen:2021-02-25 06:33:19 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:/Oa/Jj59HTrVO2ja3RtVliZaJvsSgue2Ca8NMaP2u91Hp1Nbd4/uCXsDsx9LoWs2:2aBlpTk2OtVQwRsFu9HezbdcLXsDwnf
TLSH 82942356B3DE8914E2277D28BC4C321E17971D5A6F261F00932D22A4D1AC17BC86BFDE
Reporter @cocaman
Tags:gz


Twitter
@cocaman
Malicious email (T1566.001)
From: "info <info@premierpearltea.com>" (likely spoofed)
Received: "from postfix-inbound-3.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "25 Feb 2021 03:59:17 +0100"
Subject: "Request for Qoutation"
Attachment: "RFQ pdf.tar.gz"

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
High
Geo location:
CH Switzerland
Volume:
Low
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.27755.27967.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39
Detection:
n/a
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 06:39:09 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
8 of 47 (17.02%)
Threat level
  5/5
Detection(s):
Suspicious file
Link:
https://www.spamhaus.org/query/hash/5iklf4cvolbaq3563zp547dlss2ptiwtpbuayzlfcdzsxukely4q._file
AV coverage:
11.67%
AV detections:
7 / 60
Link:
https://www.virustotal.com/gui/file/ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39/detection/f-ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39-1614062315
Threat name:
Malicious File
Score:
1.00

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39

(this sample)

AgentTesla

Executable exe 80622d6bf536ca1e21f411864d3c4af7f4ebded98ea3aeeb6c99b964b247e3ca

AgentTesla

gz 476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 476de54b5de9af5f45faf864bd1a46802e58975f98e38c1624b30832a7695cd6

Comments