MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e2689da5129cfb44bfbb6ead2db8c36d05e65b8ae9b9c056e6927dfb1bfcb13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e2689da5129cfb44bfbb6ead2db8c36d05e65b8ae9b9c056e6927dfb1bfcb13
SHA3-384 hash: fe3e10f6b58c76322f0dfd79c08fa76ddedaebbd12f0aa27e2ecc7f46d0b39b5eee102d9a4264efb59ab9d9c6ae932fe
SHA1 hash: a366cb4964ba19b89bca3c8755d136ee943409bd
MD5 hash: 092b5075676b61778cb8d4ec5b266aaf
humanhash: blue-hotel-zulu-cold
File name:QUOTATION DETAILS.rar
Download: download sample
File size:288'195 bytes
First seen:2020-11-03 06:15:36 UTC
Last seen:2020-11-03 11:11:27 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:V15n17WrnMcHezU5z04EOB7zig8ZmkqBfB2w0eaRZ1Fxw6GBqb8FeSlm:Vvn10Maz0HOBSjmF52/euZ1FC68qb/S4
TLSH 4F54232E2017CF18587BC44BBFFC568CD4E153C7AF6914D6946CFE65D2CC6222878A8A
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Syahida,Farah"<farah.syahida@dlk.com>"
Received: "from dlk.com (unknown [103.99.1.140]) "
Date: "03 Nov 2020 02:51:01 -0800"
Subject: "Quotation Invoice"
Attachment: "QUOTATION DETAILS.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e2689da5129cfb44bfbb6ead2db8c36d05e65b8ae9b9c056e6927dfb1bfcb13/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-02 20:42:17 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nytitwsrfhh3is73w3vnfw4mg3if4znyv2nzyblonet57mn7zmjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e2689da5129cfb44bfbb6ead2db8c36d05e65b8ae9b9c056e6927dfb1bfcb13

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 6e2689da5129cfb44bfbb6ead2db8c36d05e65b8ae9b9c056e6927dfb1bfcb13

(this sample)

Executable exe 53858fad21d7906f8ea2adf425329af0ca0a9db839e63a8c49d51b568e3bfb31

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53858fad21d7906f8ea2adf425329af0ca0a9db839e63a8c49d51b568e3bfb31

Comments