MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb316023b967173374bcf1ff23a0a9d0abafc6ae392400eae0c517a779ae9e3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb316023b967173374bcf1ff23a0a9d0abafc6ae392400eae0c517a779ae9e3a
SHA3-384 hash: e7d9b094409d178fdb8d21a840aec80e973d5320f5ec0db5c6e41d7032ccafa20b8459e4f759a803e7ece1e23af81bfc
SHA1 hash: 4a776823debaf250d81ec502ae0218d725841760
MD5 hash: 366f8583beb5a5fae861259ccccfdfa1
humanhash: fifteen-eighteen-nine-undress
File name:QRN-CLJC-06112020149.PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:475'042 bytes
First seen:2020-11-16 13:18:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:6nB8vYSc0TdzS1r00NVlT/CjlU6EU/wO/i8ydOb:6nBSYQdu1rhPChKq/0dOb
TLSH A5A42342A5CFB3EC4B8EB14767D116DF92E0E1B62505C5D2DECBC4A1A909D23A4DB20A
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Fernando Zati <fzat@chevorn.com>" (likely spoofed)
Received: "from chevorn.com (unknown [199.96.83.10]) "
Date: "16 Nov 2020 05:17:29 -0800"
Subject: "Quotation Request for QRN-CLJC-06112020149"
Attachment: "QRN-CLJC-06112020149.PDF.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb316023b967173374bcf1ff23a0a9d0abafc6ae392400eae0c517a779ae9e3a/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 04:34:42 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 28 (60.71%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmywai5zm4ltg5f46h7shifj2cv27rvohesab2xayul2o6noty5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cb316023b967173374bcf1ff23a0a9d0abafc6ae392400eae0c517a779ae9e3a

(this sample)

AgentTesla

Executable exe 13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
  
Dropping
AgentTesla

Comments