MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6fcf46f2407a3ff96740a391bb95061771721d3b4578bda5e2c432f44de6af2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6fcf46f2407a3ff96740a391bb95061771721d3b4578bda5e2c432f44de6af2
SHA3-384 hash: 7a7dc0e6968b8c26bb755433ebd60b5c08b232c54cfd9dcf4ed13b3f0121f43249c88ad43c29f85138017b145363f402
SHA1 hash: f5a3afae029e43ba1728eec90737d76784a7f481
MD5 hash: 49d2483c5b576eb204bfe7d7722d7bcd
humanhash: sad-fanta-cardinal-burger
File name:Order Inquiry.Jpeg.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'633 bytes
First seen:2020-12-09 17:10:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:UJtTWFi5a0TDv6JIcVSJO7iFFzWV5DUOLJZ62p6dJZU24iuy6zkpu82YQ6XSWdBH:86i5yJzivKBrJZGT4iuD4D2n6lH
TLSH BC942386A0B02D3EA62D1FE909A12E6B6D77BB545124F0C4E4D6634ED6903AB7C134FC
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Gas Arabian Services <aquib@gasarabian.com>" (likely spoofed)
Received: "from iqum.mx (unknown [67.227.222.135]) "
Date: "09 Dec 2020 09:08:14 -0800"
Subject: "Please review our attached inquiry "
Attachment: "Order Inquiry.Jpeg.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6fcf46f2407a3ff96740a391bb95061771721d3b4578bda5e2c432f44de6af2/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 17:10:06 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u36pi3zea6r77ftubi4rxokqmf3roiotwrlyxws6frbs6rg6nlza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a6fcf46f2407a3ff96740a391bb95061771721d3b4578bda5e2c432f44de6af2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a6fcf46f2407a3ff96740a391bb95061771721d3b4578bda5e2c432f44de6af2

(this sample)

AgentTesla

Executable exe ef9af7994d5d9ac283134b522ae1e1680eecee19974bf717fc5cb50d69b5d371

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef9af7994d5d9ac283134b522ae1e1680eecee19974bf717fc5cb50d69b5d371
  
Dropping
AgentTesla

Comments