MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8d85ad961e733862653a679c5770be37047ec68080a79b901c490d1d64ce262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8d85ad961e733862653a679c5770be37047ec68080a79b901c490d1d64ce262
SHA3-384 hash: f1cee45faceab92119610244603bd445c64a554d274fb0496b3d69192b7a72fd846b141c5cb18a0ad71b6807aabdf93b
SHA1 hash: 848f37c08dbb1c274439206011724bd19d40d4de
MD5 hash: 27cf397cf0b6eb426200e3cab61ec868
humanhash: nuts-virginia-kilo-north
File name:RFQ40623.rar
Download: download sample
File size:507'619 bytes
First seen:2020-10-06 06:06:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:5qTpw7/c/UAROpOh+7KaA7PppUlf3V1THA8MELMmyEuWqQDghoWQkAmg4nIf1lzs:5L7/cs6bj7PIdzzpMELMlQDghuUErmN
TLSH E2B4230E6C58AF27F96B078D5C82ACA098BCCA37D863C3D853D64BE3B32F9551D65102
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: virtualhost.com.tw
Sending IP: 175.183.3.134
From: Antony Tsai-KSB Taiwan <antony.tsai@ksb.com>
Reply-To: jr210131mr@gmail.com
Subject: RFQ#40623
Attachment: RFQ40623.rar (contains "RFQ#40623.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8d85ad961e733862653a679c5770be37047ec68080a79b901c490d1d64ce262/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 03:27:45 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdmfvwlb44zymjstuz44k5yl4nyep3dibafhtoibysindvsm4jra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c8d85ad961e733862653a679c5770be37047ec68080a79b901c490d1d64ce262

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar c8d85ad961e733862653a679c5770be37047ec68080a79b901c490d1d64ce262

(this sample)

Executable exe 82e83d252610457f622c416ff561c954243eac2f0eac248cf483756c138573c5

  
Dropping
MD5 dade167243f46e6e92265fb9aa263754
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82e83d252610457f622c416ff561c954243eac2f0eac248cf483756c138573c5

Comments