MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a34682cb267c1171fcf2dd078b4a4050f2ef6275d39cf589cd8f2fb784671496. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a34682cb267c1171fcf2dd078b4a4050f2ef6275d39cf589cd8f2fb784671496
SHA3-384 hash: e839f52b6c01446005a4502fbc281f8ac270f2b3c221e1b10dfdaf26888a8597d1b0af2348a225891a08dc67f3228cab
SHA1 hash: 2d106f294d31f8c19d6bcdf73260264ef79781c1
MD5 hash: e61a82ed744deaac96435497a1f17495
humanhash: music-angel-echo-robin
File name:RFQ#11072022.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2022-11-07 06:58:09 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:XziJG7VZQ5L9bRIe2W8ZUNRp4DBg0I2rqkH7Y:XzUGj6RIU8Zq8DBg0I2rX7
TLSH T1AD45D0A484F59923F46E1FB313832CB26C627D499CD59B2F688E31D3437CAB226D9C45
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:AgentTesla img QUOTATION RFQ


Avatar
cocaman
Malicious email (T1566.001)
From: "Sharjah Oman Engineering <info@soecgroup.com>" (likely spoofed)
Received: "from [193.47.61.199] (unknown [193.47.61.199]) "
Date: "6 Nov 2022 14:44:28 -0800"
Subject: "REQUEST FOR QUOTATION"
Attachment: "RFQ#11072022.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:RFQ_1107.EXE
File size:521'728 bytes
SHA256 hash: 3cff9feae6b20355c809200752718f77289eb3047459663273ad7b24db351cfd
MD5 hash: 54c9888d629ad2bf65ec0e374a9717ed
MIME type:application/x-dosexec
Signature AgentTesla
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
context-iso evasive packed
Link:
https://www.filescan.io/uploads/6368acb715611f8d8bf94473/reports/f0ca1359-d6d4-49ac-8431-927927fe92a5/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a34682cb267c1171fcf2dd078b4a4050f2ef6275d39cf589cd8f2fb784671496/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-06 18:42:55 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
15 of 41 (36.59%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=undifszgpqixd7hs3udywssakdzo6ytv2ooplconr4x3pbdhcsla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/a34682cb267c1171fcf2dd078b4a4050f2ef6275d39cf589cd8f2fb784671496

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a34682cb267c1171fcf2dd078b4a4050f2ef6275d39cf589cd8f2fb784671496

(this sample)

AgentTesla

Executable exe 3cff9feae6b20355c809200752718f77289eb3047459663273ad7b24db351cfd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3cff9feae6b20355c809200752718f77289eb3047459663273ad7b24db351cfd
  
Dropping
MD5 54c9888d629ad2bf65ec0e374a9717ed

Comments