MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



AgentTesla


Vendor detections: 6


Intelligence 6 File information Yara Comments

SHA256 hash: ea14b2f05572c2086fbede5fde7c6b94b4f9a2d378680c656510f32bd1445e39
SHA3-384 hash: d7e50fbe22c14822258b36c7bb6d4983d3e20d5335fdae728fea8b2dd60cb3549886ed537bdcf40d84fd3f8a2f66ecdd
SHA1 hash: ae06c4ce12b656be056cc366b4661cd84b19d674
MD5 hash: 677f7c3940ef835ff36bb7ac948bf805
humanhash: fruit-august-finch-hotel
File name:RFQ pdf.tar.gz
Download: download sample
Signature AgentTesla
File size:418'000 bytes
First seen:2021-02-23 06:38:31 UTC
Last seen:2021-02-25 06:33:19 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:/Oa/Jj59HTrVO2ja3RtVliZaJvsSgue2Ca8NMaP2u91Hp1Nbd4/uCXsDsx9LoWs2:2aBlpTk2OtVQwRsFu9HezbdcLXsDwnf
TLSH 82942356B3DE8914E2277D28BC4C321E17971D5A6F261F00932D22A4D1AC17BC86BFDE
Reporter @cocaman
Tags:gz


Twitter
@cocaman
Malicious email (T1566.001)
From: "info <info@premierpearltea.com>" (likely spoofed)
Received: "from postfix-inbound-3.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "25 Feb 2021 03:59:17 +0100"
Subject: "Request for Qoutation"
Attachment: "RFQ pdf.tar.gz"

Intelligence


File Origin
# of uploads :
2
# of downloads :
41
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
High
Geo location:
CH Switzerland
Volume:
Low
Vendor Threat Intelligence
Threat name:
Win32.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-02-23 06:39:09 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
8 of 47 (17.02%)
Threat level
  5/5
Threat name:
Malicious File
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail attachment

Comments