MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1621a14de079f483d9557565ec120218e91f0bb1a3c1d69d002e66497c6d6e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1621a14de079f483d9557565ec120218e91f0bb1a3c1d69d002e66497c6d6e2
SHA3-384 hash: ff12a381afaf85b16efe2ddeb97e3a0c41ac15136fd225b5b35f5d7c7ae5cf43da92ac4417dc2dd9945245b149bb6f81
SHA1 hash: 1966f17ef29757af9b34167823f2482faadfbb38
MD5 hash: cc118c9c5f383e9519491e8314b4415c
humanhash: oklahoma-earth-apart-double
File name:RFQ -H56376.PDF.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-16 13:44:35 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:BksXyGAL1CPjD+eXtCvIxs7mKDoGegHiB+st0hsAcfyrVQJ:BkzLgPn+golmKDoGbIrhfyre
TLSH 7045D02523586FA1F47DA37B60A0156023FABD86D335DA497DEC72CE7B72B844262703
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: saudixerox.com
Sending IP: 83.149.106.1
From: Lacy (Purchase Manager) <a.alshaikh@saudixerox.com>
Subject: Re: Re: Re: Aw: Request for Quotation
Attachment: RFQ -H56376.PDF.IMG (contains "0QQs6KpHwuVUX7Z.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.11616.14357.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1621a14de079f483d9557565ec120218e91f0bb1a3c1d69d002e66497c6d6e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 11:31:02 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yfrbufg6a6puqpmvk5lf5qjaeghjd4f3di6b22oqaltgjf6g23ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1621a14de079f483d9557565ec120218e91f0bb1a3c1d69d002e66497c6d6e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img c1621a14de079f483d9557565ec120218e91f0bb1a3c1d69d002e66497c6d6e2

(this sample)

AgentTesla

Executable exe 4edd4c06c8b7cca23fce60e854323b80835e64c805daef22994f2d3d743dd83b

  
Dropping
MD5 4ef7422bd10c5aae71b2bea7e5a2ba89
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4edd4c06c8b7cca23fce60e854323b80835e64c805daef22994f2d3d743dd83b

Comments