MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b2e8edf3e50e07a223ed5bb0aec96199294b93ce873a20b3831011fd8c2cbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45b2e8edf3e50e07a223ed5bb0aec96199294b93ce873a20b3831011fd8c2cbf
SHA3-384 hash: 7280de4b563e3da006969017c244122ac7b42bcebb88772882f7cb25c9cbbbf7e16e50a65e20a38f1ba50abd934c73db
SHA1 hash: d02d20febdb17ab368f1fdfa0ce50152a8713554
MD5 hash: f9454d35d93094f7e600f9199ef1f5f8
humanhash: victor-maine-eight-stairway
File name:QUO QMJ201706001.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:628'161 bytes
First seen:2020-12-17 08:49:17 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:ydKTHe2OdsjMY5eZIcE1V07/hlSws5b4trCJB8MDyvQD6Tzm/t039:qYHe2THF91V0jSwsZ9Ty4eXm/q39
TLSH 37D423F3E129DEC82E24AF83E4933083FE6543264F8B50D5A792474D1EC626693C6978
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: www.prosygma-cm.org
Sending IP: 5.189.186.123
From: Rozh Diar <rozh.diiar@qaiwangroup.com>
Subject: BPC-PR369-Electrical-Electric Motor Rewinding, Transformer and Electric Motor Repair
Attachment: QUO QMJ201706001.arj (contains "QUO QMJ201706001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.12091.26813.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45b2e8edf3e50e07a223ed5bb0aec96199294b93ce873a20b3831011fd8c2cbf/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:50:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iwzor3pt4uhapird5vn3blwjmgmsss4tz2dtuiftqmibd7mmfs7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45b2e8edf3e50e07a223ed5bb0aec96199294b93ce873a20b3831011fd8c2cbf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 45b2e8edf3e50e07a223ed5bb0aec96199294b93ce873a20b3831011fd8c2cbf

(this sample)

AgentTesla

Executable exe e2b7ea3f36ee9c137c8b52e44c82965f11ccb6c61ad037402416b2c75a532a1e

  
Dropping
MD5 562819f1c14f937fdf494e8dfe61bed3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2b7ea3f36ee9c137c8b52e44c82965f11ccb6c61ad037402416b2c75a532a1e

Comments