MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea4893a18ae86f46cb28a7d7d9274184a7737354520269ada72db25105b5a04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ea4893a18ae86f46cb28a7d7d9274184a7737354520269ada72db25105b5a04
SHA3-384 hash: 644cb800f692fc07634382bb07299065f71d20b40e4c461b38265f48eaa4341a3fb82247280442ae1c674178000dd72c
SHA1 hash: f1b840dd54d0c15ce67e1573959ac163e20d44d2
MD5 hash: 5943c41109191b42c7f98a26234937bd
humanhash: pasta-oxygen-undress-fifteen
File name:Invitation (Bid Request for Quotation).com.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:711'899 bytes
First seen:2021-04-08 05:32:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:+tDATwpj2dEQ81AGIKNFtrw6wpWd1PGEh+p6G/USArqE:vMpj7f1AGIhE1+plMSgqE
TLSH FCE4239D71C7E2C27CE5240381387AEE72D68F25CB2E5022C63954125D3D4B78AE77BA
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Naza N . Syawesh<nsyawesh@huntoil.com>" (likely spoofed)
Received: "from huntoil.com (unknown [45.85.90.228]) "
Date: "08 Apr 2021 01:44:02 +0200"
Subject: "RFQ"
Attachment: "Invitation (Bid Request for Quotation).com.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ea4893a18ae86f46cb28a7d7d9274184a7737354520269ada72db25105b5a04/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 23:59:58 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2sisoqyv2dpi3fsrj6x3etudbfhonzviuqcngw2olnskec3lica._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/7ea4893a18ae86f46cb28a7d7d9274184a7737354520269ada72db25105b5a04

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7ea4893a18ae86f46cb28a7d7d9274184a7737354520269ada72db25105b5a04

(this sample)

AgentTesla

Executable exe 9122c256e01d8489721f5a124686ad014bb32fb9d058dc74d966d36381fe01c8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9122c256e01d8489721f5a124686ad014bb32fb9d058dc74d966d36381fe01c8
  
Dropping
AgentTesla

Comments