MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba3184ff89a53d568a7897d9394e6475b51642f3c0721f61450d420f5be38b5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba3184ff89a53d568a7897d9394e6475b51642f3c0721f61450d420f5be38b5a
SHA3-384 hash: 9c4fbad7dfd466610bd95993d2c3ffa5b3c6ffba47a100d953e17b373c07bee188fc59ffda14a98a277ffe7553640742
SHA1 hash: 02c3e90888a0436d9f680fe6eb6001a418314c06
MD5 hash: b44e81afa12a5f33f39b5ee3c797a5bf
humanhash: quiet-ten-thirteen-juliet
File name:QUOTATION_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'231 bytes
First seen:2020-09-21 04:01:07 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:GswzMuFyDl0Gzr+AZQ6DmN/O+2HH7Mg/t2MAcMfZ:GHjFyDQcB7Mg/iZ
TLSH 498423E27BBA4439BA6A0687DE49DC7657C3C5750B4C439174630C6CAFBE5E0E4082BD
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""PT INTEGRA LINE INDONESIA." <info@domilbergltd.com>"
Received: "from server.devbox12.com (unknown [162.249.2.44]) "
Date: "Sun, 20 Sep 2020 21:42:07 -0400"
Subject: "RFQ for Supplies -202057AB"
Attachment: "QUOTATION_PDF.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba3184ff89a53d568a7897d9394e6475b51642f3c0721f61450d420f5be38b5a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-21 01:03:50 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xiyyj74juu6vnctys7mtstteow2rmqxtybzb6ykfbvba6w7drnna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba3184ff89a53d568a7897d9394e6475b51642f3c0721f61450d420f5be38b5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ba3184ff89a53d568a7897d9394e6475b51642f3c0721f61450d420f5be38b5a

(this sample)

AgentTesla

Executable exe d98f8380522e71c61b91d1fbdf98c0528fc20388a85695529824754f00a183a1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d98f8380522e71c61b91d1fbdf98c0528fc20388a85695529824754f00a183a1

Comments