MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb996a6fb7d92f11ffb3effddbd11878ecedb3ab48005144a6e2c9533d0b3e2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb996a6fb7d92f11ffb3effddbd11878ecedb3ab48005144a6e2c9533d0b3e2f
SHA3-384 hash: bec70e6045f7b0330912f9ada1201ab967d7c4cf959251d775d748163c3fc772c8c489a72ad64d9dd56cda82a1d14a75
SHA1 hash: c66ad0603c7321b985eda727af819428c67674b4
MD5 hash: e15bf6b638b7fc79c4e55b48261f5a73
humanhash: lemon-don-fillet-wolfram
File name:Quote JQ102474.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:488'348 bytes
First seen:2021-02-10 09:31:14 UTC
Last seen:2021-02-10 13:39:18 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:OX1ureJ9HTctiX5l8W5YSpGCfn/cyE1xTzDxqHTGZrqj:OX1ZTctS8A1pt/UyE1lfxqHTGUj
TLSH 3EA4234BCF39366804C9F592A1C27A27854FDE6C541414BECEFBAA8D70B0AC7E661137
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Haiyan Zhao <sales@souriau.com>" (likely spoofed)
Received: "from souriau.com (unknown [103.133.107.38]) "
Date: "10 Feb 2021 04:11:40 -0800"
Subject: "RE: [Quote JQ102474]RE: new RFQ"
Attachment: "Quote JQ102474.pdf.rar"

Intelligence

File Origin
# of uploads :
10
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20210211-0741.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb996a6fb7d92f11ffb3effddbd11878ecedb3ab48005144a6e2c9533d0b3e2f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 09:32:10 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xomwu35x3exrd75t5765xuiypdwo3m5ljaafcrfg4levgpilhyxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bb996a6fb7d92f11ffb3effddbd11878ecedb3ab48005144a6e2c9533d0b3e2f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bb996a6fb7d92f11ffb3effddbd11878ecedb3ab48005144a6e2c9533d0b3e2f

(this sample)

AgentTesla

Executable exe 19ac9ca7fc7e710f25432fdbdef8b5dd5d1ebe1ad6fa5607e89c09815d40e062

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 19ac9ca7fc7e710f25432fdbdef8b5dd5d1ebe1ad6fa5607e89c09815d40e062
  
Dropping
AgentTesla

Comments