MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 485d8a45506fad529a2912f91ebe80dfb606918364f36442f3816db88dcf297b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 485d8a45506fad529a2912f91ebe80dfb606918364f36442f3816db88dcf297b
SHA3-384 hash: de46999cb19d269abb989c9782fbb6e3cbc182edd66a57227bd25c404b275c8aca74f572f1e97c9a8b6810fb2f828bf7
SHA1 hash: 0362416ade643f12e1bfe1202a602b7aac3790cf
MD5 hash: dc56b889a2cffa2bf0e55043e35af58f
humanhash: bravo-oregon-beer-quiet
File name:RFQ061220210308.LZH
Download: download sample
Signature AgentTesla
Create hunting rule
File size:805'622 bytes
First seen:2021-03-09 15:48:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:cQpHC2f8BDpOViNbTTAY8pvZTxU5Mf4MpDSUCmCG0GDM2bRvbausQ0CspAHJxwz3:BC5DpOVpB3f/pDS4F0L2bRDeCX7MN
TLSH 0E053313ED5805CD2CD314EFAC2FD01291F5D9A627EC98A8C20A572F4EB667DAD90F09
Reporter abuse_ch
Tags:lzh


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: owi-inc.com
Sending IP: 5.181.166.247
From: Sherrill Redmon<sales1@owi-inc.com>
Reply-To: Sherrill Redmon <ctstech@gmail.com>
Subject: RFQ061220210308LZH
Attachment: RFQ061220210308.LZH (contains "RFQ061220210308.COM")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 09:59:01 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jboyurkqn6wvfgrjcl4r5pua363anemdmtzwiqxtqfw3rdopff5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/485d8a45506fad529a2912f91ebe80dfb606918364f36442f3816db88dcf297b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 485d8a45506fad529a2912f91ebe80dfb606918364f36442f3816db88dcf297b

(this sample)

AgentTesla

Executable exe ec694537528f39e61c4a295e99932641ac2660f8580911790926294c4a190afc

  
Dropping
MD5 f3ab94e0b3775d25c469a5a1239b4b80
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec694537528f39e61c4a295e99932641ac2660f8580911790926294c4a190afc

Comments