MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4fbcb41813bdae4785cc3abe44e32fbcf01f2089b031d1ec234e6e33a3ac0c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4fbcb41813bdae4785cc3abe44e32fbcf01f2089b031d1ec234e6e33a3ac0c6
SHA3-384 hash: 306b3b0bebd52b4b87bc2ff3daa73c764b1c80cbb0c3a513d1198f1f3d552e73cdc5eb5ffd9e0a3950f608812c0e1697
SHA1 hash: 31f5d93772d5755c1808ea0d90bbcd04b1ea114a
MD5 hash: 2616c1cafd9d3a2e65e7f3f581ad5639
humanhash: delaware-dakota-pip-william
File name:RFQ- REQUEST FOR PRICE VALVES AND GALVANIZED PUMPS_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'090'266 bytes
First seen:2020-05-11 09:02:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:qjrb+u7T2eN9o6oef9VId0ai8joeRuIcfUXwLMjBMRAHLEngDQ/c+1F:qXJ/2eA6oi9k0IjoKupMggFMRARDkc+X
TLSH BF3533CD11A06BFB7BFCB1742E05543655C1289AF7A74BC13524CBAC087266FAB817B2
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: <glen@esears.xyz>
Received: from box.esears.xyz (box.esears.xyz [138.68.28.142])
Date: Mon, 11 May 2020 10:50:34 +0300
Subject: RFQ 200043 - Request for Quote for Galvanized Pumps and Valves
Attachment: RFQ- REQUEST FOR PRICE VALVES AND GALVANIZED PUMPS_pdf.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:41 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yt54wqmbhpnoi6c4yov6itrs7phqd4qitmbr2hwcgttogor2ydda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c4fbcb41813bdae4785cc3abe44e32fbcf01f2089b031d1ec234e6e33a3ac0c6

(this sample)

AgentTesla

Executable exe 2b85e0e2f5a403345a30ce5b0e36a40723f0354259d710de5a4508ccd372aca7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b85e0e2f5a403345a30ce5b0e36a40723f0354259d710de5a4508ccd372aca7

Comments