MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 225a8778158c10331c753ef6c773a4539d76bded725045a955b6ca73d6c7b111. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 225a8778158c10331c753ef6c773a4539d76bded725045a955b6ca73d6c7b111
SHA3-384 hash: 7f7c8d08beaae84fa36e320f85a9ccd59b305be524174c9029b401a9d273290c3edc92520af510959dcb283613ecbf98
SHA1 hash: d725c7ce3bad43d936aa8fcc77a73880629f06f2
MD5 hash: b5fc2423c460b3b92ccc759d1be8834c
humanhash: eleven-twelve-lake-venus
File name:QUOTE B1019823.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:565'097 bytes
First seen:2020-08-13 06:40:16 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:7jLzLKMIlEq4ZghASO0SloCGcVLzwhFSOu4lJ/e7qtx+RKPTZm:7fXKM0Eq4aASONlqcVYQ0y6MsTg
TLSH 88C423BDAFD0682130DBCACEB45ADC0E945FF106061A2B27E94E1FB526817975643FC4
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Trikora Ibnu <sales@ddac.com.cn>
Received: from ddac.com.cn (unknown [37.48.85.232])
Date: 13 Aug 2020 06:32:31 -0700
Subject: REQUEST FOR QUOTATION (RFQ REF: B1019823)
Attachment: QUOTE B1019823.pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/225a8778158c10331c753ef6c773a4539d76bded725045a955b6ca73d6c7b111/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 06:42:06 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ejnio6avrqidghdvh33mo45ekooxnppnojielkkvw3fhhvwhweiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/225a8778158c10331c753ef6c773a4539d76bded725045a955b6ca73d6c7b111

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 225a8778158c10331c753ef6c773a4539d76bded725045a955b6ca73d6c7b111

(this sample)

AgentTesla

Executable exe 7dc944bd0d2dafb252d4388f45a7d624ac5b6cf79ddfe72e3b5fb2db08ab1850

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7dc944bd0d2dafb252d4388f45a7d624ac5b6cf79ddfe72e3b5fb2db08ab1850
  
Dropping
AgentTesla

Comments