MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3eacaf9de202012bcc52ac356e4d6cba8656422f65d26a2965b394262cdb1ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3eacaf9de202012bcc52ac356e4d6cba8656422f65d26a2965b394262cdb1ad
SHA3-384 hash: 0566dd2f64d979a36cf260fbd3beca223cd70a4edc3447e4b3cc239328a22d480075d0a561fabd81fb7c9186d7ca5c02
SHA1 hash: 92a20f5a4680b986dd19a09ca408c58ee0cb782f
MD5 hash: b1cd7a809cdc6c84705a8828c346c03a
humanhash: summer-enemy-one-angel
File name:Request for Quotation Website Inquiry - Information Designs and Specifications sheet 00011020020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'620 bytes
First seen:2020-11-25 11:58:48 UTC
Last seen:2020-11-25 11:59:21 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:5VvSuMcIlDWNtbB2qk5rjerJ/t648fXjT/LMrnoq1HUKD3Eaf3tNN3zv+pWaLt6j:5Vv6DGbBd4eN/tmfTT/M/m4xfo7o
TLSH 889423805D39295881037B40DA0F81549B30D792B4FB3BCD17A47738F9BD29B46BEEA9
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Fakhri A. Huseynov" <fakhri.huseynov@fabboya.com>" (likely spoofed)
Received: "from box.fabboya.com (box.fabboya.com [134.122.48.152]) "
Date: "Wed, 25 Nov 2020 02:47:43 -0800"
Subject: "Quotation request inquiry"
Attachment: "Request for Quotation Website Inquiry - Information Designs and Specifications sheet 00011020020.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3eacaf9de202012bcc52ac356e4d6cba8656422f65d26a2965b394262cdb1ad/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 11:59:04 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c3eacaf9de202012bcc52ac356e4d6cba8656422f65d26a2965b394262cdb1ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c3eacaf9de202012bcc52ac356e4d6cba8656422f65d26a2965b394262cdb1ad

(this sample)

AgentTesla

Executable exe 4c67722d6cbbdf3ca55c350488c348f1ccc5177727bd008c10856b16c8510b69

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c67722d6cbbdf3ca55c350488c348f1ccc5177727bd008c10856b16c8510b69

Comments