MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6081a28045e31a0ce5fd473609bc0ae3c0c427fb9c58fea3a527273e38a2caf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6081a28045e31a0ce5fd473609bc0ae3c0c427fb9c58fea3a527273e38a2caf7
SHA3-384 hash: 6e31c588ba571524d007963f0bb8b2540dd5e23b2955dc23bf75b6cdbd61f197676b43a20d1a0d1fb5a65b3240e01602
SHA1 hash: 91a5a69517a082a6a2ac158d4aaf98790e36b4f4
MD5 hash: 0ddb2cccc572baa850ee315955acaebf
humanhash: kitten-double-failed-eighteen
File name:RFQ_110109564 11010965483- Vogue Sourcing Chennai Office.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:519'907 bytes
First seen:2021-03-02 08:07:32 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:qYRK6GyBclNss+DzXpqoBSzr55Ku8bvFDRjPPpKFgZwV7d4M:UuKlNssW7pqDh5KucjjP0J
TLSH 88B4236E2C3B7C1D34D85C7B8B20A0EDA36756FF4CD6A82C1859752771F60E98640EE8
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: nitro.superhosting.bg
Sending IP: 164.138.219.24
From: Vogue Sourcing Chennai Office. <productions@voguesourcing.com>
Subject: RFQ_110109564 & 11010965483- Vogue Sourcing Chennai Office
Attachment: RFQ_110109564 11010965483- Vogue Sourcing Chennai Office.gz (contains "RFQ_110109564 11010965483- Vogue Sourcing Chennai Office.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6081a28045e31a0ce5fd473609bc0ae3c0c427fb9c58fea3a527273e38a2caf7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 08:08:08 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mca2facf4mnazzp5i43atpak4pamij73trmp5i5fe4tt4ofczl3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6081a28045e31a0ce5fd473609bc0ae3c0c427fb9c58fea3a527273e38a2caf7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 6081a28045e31a0ce5fd473609bc0ae3c0c427fb9c58fea3a527273e38a2caf7

(this sample)

AgentTesla

Executable exe b86212f123c131db6d159559b4f9df3348946697ec8e2978121b925014619e5d

  
Dropping
MD5 0f5b2bfb181e2e278aa4e00860b637a1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b86212f123c131db6d159559b4f9df3348946697ec8e2978121b925014619e5d

Comments