MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32279af000e4cb6d947c18f7fd3aec79b80861ea3ebc703f07eb356129306722. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32279af000e4cb6d947c18f7fd3aec79b80861ea3ebc703f07eb356129306722
SHA3-384 hash: 9b5cdfb37ffde82aa353b619ef3a2956ab5b74853ad1a26e5d1e38bdcecda333fcc168c87dd9db1109bea09c6505fb93
SHA1 hash: 03ffedbc3d738bbb0ae13b0d9cc4694a1cd4aee4
MD5 hash: a2c5a1f312b604b2cd7e890cfc1dc4c1
humanhash: eleven-golf-winner-two
File name:New Business Inquiry Request for Quotation (MOQ and Payment Delivery Terms and Ports).rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'911 bytes
First seen:2020-11-16 09:50:41 UTC
Last seen:2020-11-16 09:53:54 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:lAQgnKYSBvjkdA0tQPxa0V/+ZbxzcH3IffTHxaCRTrd07:tgnKFkKxa05+PAHy7RaoTru7
TLSH C59423C261EA18D648D9299B835B4FCDCAEB41A2B9F0B4FF778749959EAC30300F1175
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Suraj Patel" <suraj@climax-engineering.com>" (likely spoofed)
Received: "from box.climax-engineering.com (box.climax-engineering.com [174.138.33.205]) "
Date: "Mon, 16 Nov 2020 01:11:52 -0800"
Subject: "New Inquiry - India"
Attachment: "New Business Inquiry Request for Quotation (MOQ and Payment Delivery Terms and Ports).rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32279af000e4cb6d947c18f7fd3aec79b80861ea3ebc703f07eb356129306722/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 09:51:04 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 32279af000e4cb6d947c18f7fd3aec79b80861ea3ebc703f07eb356129306722

(this sample)

AgentTesla

Executable exe 3636cc307af2413f0e2c93898c21f0441c053c2d7d28bff18f677fdc90de1917

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3636cc307af2413f0e2c93898c21f0441c053c2d7d28bff18f677fdc90de1917

Comments