MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbef131efa1b2aa7b21ef6de56e187b1bd9bb81533db23a5d78d2fbf95a6817c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbef131efa1b2aa7b21ef6de56e187b1bd9bb81533db23a5d78d2fbf95a6817c
SHA3-384 hash: 0c6b06b4e1e224b12d79287645f4fe326405ca2e58d403f7ac7fa924a814eb8d79c6467eb45b010441d237e1dc7ec2cd
SHA1 hash: 1b6dad1762ddb91dbeea9275d0cfd398941dbddc
MD5 hash: 84d57e8777554bcf3bbfe53be049215b
humanhash: double-angel-uncle-alpha
File name:Stock Materials.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'887 bytes
First seen:2021-03-30 12:18:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:l+0guHSnDBW1TxnjRuLGBZl7y+1Oum3/5sv/F7XoQnjCUiGiZWUbM8QMhBR6s3u+:lMDBqt7Bb7ou8/527XJPTIWAQqtu+
TLSH D994234FFECB906A09860DFE972F4A851DED226B3075AD493636120C9E45BCE9F34718
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: apex.kilihost.com
Sending IP: 50.28.40.153
From: Ceylon Corporation LTD<procurementexecutive2@ceylonsteel.com>
Reply-To: hfelix@rotammexico.com.mx
Subject: Request For Quotation And Supply Of Materials
Attachment: Stock Materials.rar (contains "Stock Materials.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.3942.30622.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbef131efa1b2aa7b21ef6de56e187b1bd9bb81533db23a5d78d2fbf95a6817c/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 12:19:05 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpxrghx2dmvkpmq663pfnymhwg6zxoavgpnshjoxrux37fngqf6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbef131efa1b2aa7b21ef6de56e187b1bd9bb81533db23a5d78d2fbf95a6817c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bbef131efa1b2aa7b21ef6de56e187b1bd9bb81533db23a5d78d2fbf95a6817c

(this sample)

AgentTesla

Executable exe 866aae77aac5ac5f4b6bae2e93d42231c5d47c5c9d8c030310bcc4c05a465b49

  
Dropping
MD5 0c7f488392160de57038252ab7a35ecb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 866aae77aac5ac5f4b6bae2e93d42231c5d47c5c9d8c030310bcc4c05a465b49

Comments