MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56d320af797d2bc4fa3f14670c336fa35c07e8e5e7b7395528f390d4264d68e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56d320af797d2bc4fa3f14670c336fa35c07e8e5e7b7395528f390d4264d68e9
SHA3-384 hash: 67e79000d8f5d6570f52cc3664e0d2decd8cab6b3d2c97d2ae310377eeb862f0a0b13e470a0ce26d2729647f56ca9f5e
SHA1 hash: dce6d4dc56f77838233c30e1e30b57bae80f59fc
MD5 hash: bc9bc0c6e80b2e27335aa790794b6a01
humanhash: triple-finch-jig-lake
File name:Request Quotation.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:592'507 bytes
First seen:2020-08-14 10:43:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:oXTO6HaGBCVNpKJTM2psJpoAqN9J6vsfVBNeMxoioVy6b4dH:oXTOiakCVK1M2psJpbqNuvQf7uiX/
TLSH 5DC423D18622E567FA33FF88123F7C0565D7B76B0FA2C5F23AE8441461D0C2286A9DD9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.environment.go.ke
Sending IP: 41.89.1.174
From: ADMIN <cas@environment.go.ke>
Subject: Request Quotation
Attachment: Request Quotation.rar (contains "Request Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56d320af797d2bc4fa3f14670c336fa35c07e8e5e7b7395528f390d4264d68e9/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:45:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k3jsbl3zpuv4j6r7crtqym3punoap2hf463tsvji6oinijsnnduq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/56d320af797d2bc4fa3f14670c336fa35c07e8e5e7b7395528f390d4264d68e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 56d320af797d2bc4fa3f14670c336fa35c07e8e5e7b7395528f390d4264d68e9

(this sample)

AgentTesla

Executable exe cc8ad11df1192307ecce6b0f449f2a5aeea485be15d98ff4fa9283bc70948e30

  
Dropping
MD5 156a582a1d670c85ffa30e7bc1d9ff19
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc8ad11df1192307ecce6b0f449f2a5aeea485be15d98ff4fa9283bc70948e30

Comments