MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cd890b3b8d2be8ba19b3fa347622e4f628984938dabec2926d1b22424d3d8cc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | cd890b3b8d2be8ba19b3fa347622e4f628984938dabec2926d1b22424d3d8cc1 |
|---|---|
| SHA3-384 hash: | 99f24bf63b18379869750598ab5c0f1095c1fa3511cff3f24830d00176f0d3c8f0caed65046b9b6cfb3008e639fc1579 |
| SHA1 hash: | be9f0810e7b6e99fbae73dc1e15107355dd5755d |
| MD5 hash: | bdf3b08d3b7d4ec80598264dcc35d9f7 |
| humanhash: | magnesium-carpet-william-comet |
| File name: | QAOTATION.r13.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 376'832 bytes |
| First seen: | 2020-11-07 10:27:04 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3c71e8f02dc3eee71c99d7c46768840f (4 x AgentTesla, 3 x Formbook) |
| ssdeep | 6144:zHX7q20wZiDh+m7APvvGmjxFJ3MXWSkV3Jfb2q1vyV7TmaXAuhr9MSAPVSj9orgz:zHX7z0wXmcLJ8XA5fxa7TmO5tAPVSj9n |
| Threatray | 14 similar samples on MalwareBazaar |
| TLSH | E984F13539C0C073E4A729340670DBB14E3EFA702F65589FA391177AAF743C2962996B |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing unidentified malware:HELO: safasteel.com
Sending IP: 185.136.170.140
From: sales@safasteel.com
Subject: QAOTATION
Attachment: QAOTATION.r13.exe
Intelligence
File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj
Score:
68 / 100
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2020-11-06 20:57:19 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 4 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
8c3f53a4cadb6ab150cfe8854fb57ec7445794c732713a0d38922ea3414426d8
MD5 hash:
0a3028b559e33541af2049a6229ea6b5
SHA1 hash:
348988911b788bac14790c4a586ee79d5f22fdc6
SH256 hash:
cd890b3b8d2be8ba19b3fa347622e4f628984938dabec2926d1b22424d3d8cc1
MD5 hash:
bdf3b08d3b7d4ec80598264dcc35d9f7
SHA1 hash:
be9f0810e7b6e99fbae73dc1e15107355dd5755d
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.