MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bdf001e3a9e9938882b688c82941c962c33ce6cc0b9d5f74f42cf2cd3ce1cb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bdf001e3a9e9938882b688c82941c962c33ce6cc0b9d5f74f42cf2cd3ce1cb5
SHA3-384 hash: 115e1f0635f242bb8b775cd40636f62e8a4ec20a5d25217e7de458f3a5bc0a7c6aea09e6002e952e15ac7e64212adabb
SHA1 hash: 96a083cf36a4f46061881f578ab9b9910ed2793e
MD5 hash: 60aa7346d0fa7c04b9c772cec0cdf2e5
humanhash: hotel-tennessee-undress-harry
File name:QUOTATION REQUEST.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:837'391 bytes
First seen:2020-11-22 07:16:17 UTC
Last seen:2020-11-22 07:17:54 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:KM6vSE2VzAC6Oe8Ca07CuB3G2aJRQLnLrdlJUWxp:aX2VzATdrCCra3QLdla+p
TLSH 27053364326BBB6DC05DA6B6E0EEFDDF092843340282C76519B1C470BF914679FD4786
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Nandkumar"<info@sscotspin.com>" (likely spoofed)
Received: "from sscotspin.com (unknown [103.99.1.142]) "
Date: "21 Nov 2020 20:16:14 -0800"
Subject: "QUOTATION REQUEST "
Attachment: "QUOTATION REQUEST.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bdf001e3a9e9938882b688c82941c962c33ce6cc0b9d5f74f42cf2cd3ce1cb5/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-21 07:30:28 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tppqahr2t2mtrcblncgiffa4sywdhttmyc45l52pilhszu6ods2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9bdf001e3a9e9938882b688c82941c962c33ce6cc0b9d5f74f42cf2cd3ce1cb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9bdf001e3a9e9938882b688c82941c962c33ce6cc0b9d5f74f42cf2cd3ce1cb5

(this sample)

AgentTesla

Executable exe dc0cff9e3bc575333097988f46e46f1925cedf35329a749a642576601a45674c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc0cff9e3bc575333097988f46e46f1925cedf35329a749a642576601a45674c
  
Dropping
AgentTesla

Comments