MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22db498e4f40e0580ae4f2e9077246081f986a18e938976b5b23ee202f0a9a6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22db498e4f40e0580ae4f2e9077246081f986a18e938976b5b23ee202f0a9a6c
SHA3-384 hash: e18f8a08afc9b3afad6c58e8d5e162d8c445bc846cd628ddfdbcfb06d849f9f6006ce5b0cb41a98435e8910880b48d94
SHA1 hash: b36147d9baebd9dea4a8f28df0ddf170bc04fe6e
MD5 hash: 24c2e8302292e5a7314d069642485dcd
humanhash: michigan-solar-table-ink
File name:REQUEST FOR QUOTATION (RFQ 00682020).pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'966 bytes
First seen:2020-06-08 05:44:51 UTC
Last seen:2020-06-08 08:33:05 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:bXrBAaPkYBPtnMS/azXetozI+8t38ZZevfKdWoW:bXmaPkrJbemzI+43C1dzW
TLSH 2B9423D15DDAB7467DC69A815E36C344A8B01BF769CE73A0049BF8FC3DDBA0726108A1
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: James Wang <sales@aluminiumsc.com>
Received: from aluminiumsc.com (unknown [78.129.132.154])
Date: 8 Jun 2020 06:45:42 +0100
Subject: REQUEST FOR QUOTATION (RFQ 00682020)
Attachment: REQUEST FOR QUOTATION (RFQ 00682020).pdf.gz

Intelligence

File Origin
# of uploads :
4
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200609-0823.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:30:06 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=elnutdspidqfqcxe6luqo4sgbapzq2qy5e4jo223epxcalyktjwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 22db498e4f40e0580ae4f2e9077246081f986a18e938976b5b23ee202f0a9a6c

(this sample)

AgentTesla

Executable exe 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85da156a6a3f7183f64066a1cabc2adf61ff011834f81495e52bdc2cbc047965
  
Dropping
AgentTesla

Comments