MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20c26b9af4cc5cdd27b6b7cf401dfa2e82a496cb30628fcec2202f3c6b646cc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20c26b9af4cc5cdd27b6b7cf401dfa2e82a496cb30628fcec2202f3c6b646cc7
SHA3-384 hash: 60b1b9eecff8d50f263f6d8430b0e12850d60cfbd69ad50d1a0a87bea015e6b33accfe58c0a2119614767ed39e3f87aa
SHA1 hash: 14b29f77af048e9b44e533169d36ec6f0607f826
MD5 hash: 2a1b685759fb9540fc9441cf65c5ec09
humanhash: oxygen-hydrogen-item-golf
File name:Quotation for MRS-KNRP-6842FT.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:655'750 bytes
First seen:2020-08-06 05:53:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:d/aoLliHEM6p9aAXCMkuqAl3zUGo40zfzrYvZOt20Lxx4/3tMm3b5o5CND1:QoLliVsaAXC/ZAl3zI7bzrYADLxSPtMm
TLSH 8CD423E1335D6250E50E59DE834BB3FD89A7882B0F744FEA99E1106530F7425DACEAC2
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hdac.co.kr
Sending IP: 95.211.253.201
From: Reyaz Anwar <reyaz1109@hdac.co.kr>
Subject: Request for Quotation for MRS-KNRP-6842FT
Attachment: Quotation for MRS-KNRP-6842FT.rar (contains "Quotation for MRS-KNRP-6842FT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20c26b9af4cc5cdd27b6b7cf401dfa2e82a496cb30628fcec2202f3c6b646cc7/
Threat name:
ByteCode-MSIL.Trojan.Hesv
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:54:09 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edbgxgxuzron2j5ww7huahp2f2bkjfwlgbri7twceaxty23entdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/20c26b9af4cc5cdd27b6b7cf401dfa2e82a496cb30628fcec2202f3c6b646cc7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 20c26b9af4cc5cdd27b6b7cf401dfa2e82a496cb30628fcec2202f3c6b646cc7

(this sample)

AgentTesla

Executable exe 304d5279c43c39b3b4d641a8c7b00d656f97ce2f0b7cc64a49a78042ad7d5082

  
Dropping
MD5 d8be5dcd9c6847daa589013a2264e7fb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 304d5279c43c39b3b4d641a8c7b00d656f97ce2f0b7cc64a49a78042ad7d5082

Comments