MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ed7822936ff5e5517eae4f6fd60c7d1c629f5010fd55d04a67ae773d5837983. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ed7822936ff5e5517eae4f6fd60c7d1c629f5010fd55d04a67ae773d5837983
SHA3-384 hash: 9edeb3fe5762481e628f9a3600c83865cd69653e6807d6beb7c0c477997188d83bbd59fd91b29d3c1d2fa430c0d1423d
SHA1 hash: c44570fd660105ce3294010d3dc42c55eb5d2961
MD5 hash: ac8e847ee5d389f6cd3a43011413514c
humanhash: timing-indigo-neptune-two
File name:RFQ 11054 -Items.PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:443'801 bytes
First seen:2020-09-10 05:31:35 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:JzzyzBLNVy7N6z2OygOHE9NzrV0dhNRINL+:wLNMN6z2Oyg6EN0dnRi+
TLSH B5942376882143C7A1F0BD0B3B4DACA9E6CC96171E15BCC6322DBB957F9241B95C0AF1
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: Ratna Fardilla <sales@terraenergy.com.my>
Received: from terraenergy.com.my (unknown [103.153.182.164])
Date: 9 Sep 2020 22:27:13 -0700
Subject: FW: RFQ 11054 REQUEST FOR QUOTATION - [HIGH PRIORITY]
Attachment: RFQ 11054 -Items.PDF.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200910-0746.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ed7822936ff5e5517eae4f6fd60c7d1c629f5010fd55d04a67ae773d5837983/
Threat name:
Win32.Trojan.DelfInject
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 03:17:26 UTC
File Type:
Binary (Archive)
Extracted files:
42
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l3lyekjw75pfkf7k4t3p2ygh2hdct5ibb7kv2bfgpltxhvmdpgbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5ed7822936ff5e5517eae4f6fd60c7d1c629f5010fd55d04a67ae773d5837983

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 5ed7822936ff5e5517eae4f6fd60c7d1c629f5010fd55d04a67ae773d5837983

(this sample)

AgentTesla

Executable exe 71a4df5f7ec7a6fc953f090d09b068a43b7fb10ae0050d759f32aa2e48c8377a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 71a4df5f7ec7a6fc953f090d09b068a43b7fb10ae0050d759f32aa2e48c8377a
  
Dropping
AgentTesla

Comments