MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aecf3a3662bddf3cb033da767a62a3d0255b757159a3a087a46a909717937d14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aecf3a3662bddf3cb033da767a62a3d0255b757159a3a087a46a909717937d14
SHA3-384 hash: cbcd3ab339e038c528d4d4c273ac8de0755f973fd42fbb331fcb71510e0f3623f9029b5c7ead8b9435817c1648ac55fd
SHA1 hash: 4930fbb1426d0d50792acc5b0354b10d0b0dbc41
MD5 hash: 5b14256b2058ae17a8040ddd898beca2
humanhash: fruit-fillet-oregon-ceiling
File name:RFQ_1190109423 Importance High.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'028 bytes
First seen:2020-11-02 10:39:09 UTC
Last seen:2020-11-02 13:40:52 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 6144:i0zoJ1zFM5LFx0lG2gqSaSGNLkqAG1FoLmblru4Rp8gnZ4ABx5HFHjkzxb:i0zok0EYSZ2LkqAGLtl3Rp8UWYvDkxb
TLSH C87423585E2EC4C1D8C53A558ED93399B99C9BC39EA40A1C893032681C17EF1F1B7EDB
Reporter cocaman
Tags:7z AgentTesla


Avatar
cocaman
Malicious email (T1566.001)
From: "Natasha Swart< natasha.s@thecourierguy.co.za>"
Received: "from thecourierguy.co.za (unknown [193.142.58.11]) "
Date: "02 Nov 2020 11:14:56 +0100"
Subject: "RE: RFQ_1190109423 Importance: High"
Attachment: "RFQ_1190109423 Importance High.7z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aecf3a3662bddf3cb033da767a62a3d0255b757159a3a087a46a909717937d14/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-02 10:41:06 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aecf3a3662bddf3cb033da767a62a3d0255b757159a3a087a46a909717937d14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z aecf3a3662bddf3cb033da767a62a3d0255b757159a3a087a46a909717937d14

(this sample)

AgentTesla

Executable exe 976661130d5a53498c8b1e972962c5ea4cd39971a5498f8507fb95ede9ffc7c2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 976661130d5a53498c8b1e972962c5ea4cd39971a5498f8507fb95ede9ffc7c2

Comments