MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1116ecb48249af75754b1b0555016aa178defea4f223552e3c1e027453c11be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1116ecb48249af75754b1b0555016aa178defea4f223552e3c1e027453c11be1
SHA3-384 hash: 1141aba394b9b1e8d8ad04a81886da56b3d9260b5c25a49d3f36dd880123c01306130cf89de2037676a3bb5d2a2a5caa
SHA1 hash: 12a451de2cc09d7b269deedb2d5c05a49fdc0932
MD5 hash: 6dab02fcb5b74a8252ab177259267cca
humanhash: foxtrot-salami-green-eighteen
File name:Quotation Request for Urgent Shipment - Minimum order Quantity and Fastest Lead time REF22002.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'571 bytes
First seen:2020-09-22 08:53:52 UTC
Last seen:2020-09-22 08:54:30 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:K0PUJ2KC2AouPjvAqYyLWWK8btCRi7VbzDdRjCjY6HsnbkViNLV7HJYxv:XPUspljzwy06NzxpCjQbk+Rg
TLSH 4254233130AB8E361462EC069F33393DEE65F3DB01E086EAF109CF58C59B64451BA65E
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Serkan A. SARI " <serkan@sitco-intl.co>"
Received: "from box.sitco-intl.co (box.sitco-intl.co [46.101.2.155]) "
Date: "Tue, 22 Sep 2020 01:47:27 -0700"
Subject: "RFQ#GB00033312TT //2*40HQ//FOB//UV99034080 - JJFL70010066 - DQ-277 / "
Attachment: "Quotation Request for Urgent Shipment - Minimum order Quantity and Fastest Lead time REF22002.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1116ecb48249af75754b1b0555016aa178defea4f223552e3c1e027453c11be1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-22 08:55:05 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1116ecb48249af75754b1b0555016aa178defea4f223552e3c1e027453c11be1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1116ecb48249af75754b1b0555016aa178defea4f223552e3c1e027453c11be1

(this sample)

AgentTesla

Executable exe a4b6103b1dfe717301995f598b140b0ce26e7a1541f45b6ed6485c05dca2692a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4b6103b1dfe717301995f598b140b0ce26e7a1541f45b6ed6485c05dca2692a

Comments