MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88b9f4fed28d63c89d72bcb245e542b8bde8d5f3658a5e283021bb131c9a91b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88b9f4fed28d63c89d72bcb245e542b8bde8d5f3658a5e283021bb131c9a91b9
SHA3-384 hash: f5d0fe0819153426421d2393af78dd6aa663da3748eea4d83a3ea038abae18a7491d37e22f70f2ed250321b93f196c20
SHA1 hash: c840c410dc87116f0b348704ae8dfc64a58bca51
MD5 hash: 4d6d98e9a7673aa13a83090b46751b05
humanhash: south-robin-vegan-blossom
File name:SPECIFICATION+FOR+INSTRUMENT+PIPNG-TUBING+MATERIAL..pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:558'294 bytes
First seen:2021-02-02 13:58:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:1+crK7aK6EWkNFCmn6DOoCkoibzF8KyegkQJgUgcyrVqJqJzf:E+CRW+jn64e8/Jglr8Jgzf
TLSH ABC423092EF6A59F76E8B0C7500F1B6729F89A6CD2ECFB6944B0472980D4E3B63715D0
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Desmond <desmonid@metonmas.com>" (likely spoofed)
Received: "from metonmas.com (unknown [104.216.251.52]) "
Date: "2 Feb 2021 04:14:52 -0800"
Subject: "FW: RE: [RFQ] Inquiry No.: YH01376, GPUFP, Instrument Pipe &Tub"
Attachment: "SPECIFICATION+FOR+INSTRUMENT+PIPNG-TUBING+MATERIAL..pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88b9f4fed28d63c89d72bcb245e542b8bde8d5f3658a5e283021bb131c9a91b9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 13:59:05 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rc47j7wsrvr4rhlsxszelzkcxc66rvptmwff4kbqeg5rghe2sg4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/88b9f4fed28d63c89d72bcb245e542b8bde8d5f3658a5e283021bb131c9a91b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 88b9f4fed28d63c89d72bcb245e542b8bde8d5f3658a5e283021bb131c9a91b9

(this sample)

AgentTesla

Executable exe 1dba88d2a711e0efb588cb9465a78513b45c80736ca55b31a678993eb5d89152

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1dba88d2a711e0efb588cb9465a78513b45c80736ca55b31a678993eb5d89152

Comments