MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f699f8421d732c771c717001c87a7e88fdef3ad1fb0243d3ef2c3f29a29ec9ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f699f8421d732c771c717001c87a7e88fdef3ad1fb0243d3ef2c3f29a29ec9ce
SHA3-384 hash: 989ad6da51355d52cfb091e797a47e3dab95661cde09d2a83176e609516c98923ae2884a36f75aeed98cefd4875e7869
SHA1 hash: 74f0c600308252b8aeaeeecb7bf7d50b4f1c8716
MD5 hash: d29eedef249e817a35313588c1868ae0
humanhash: timing-hamper-mockingbird-video
File name:Quotation Request Form.cab
Download: download sample
File size:435'587 bytes
First seen:2020-10-08 12:28:43 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:ncp71rRNFjuheRmAMyLuN7hC5WOUelLJA6H:nc3RNFigo558lum
TLSH DF9423F43251339647CF8062A3D85AB0E38DFBA6A5517E9C93F33CAF3A4A1250843D59
Reporter abuse_ch
Tags:cab geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm29.hanmail.net
Sending IP: 203.133.180.213
From: 옥산 <dieset129212@hanmail.net>
Subject: RE: 견적요청드립니다.
Attachment: Quotation Request Form.cab (contains "Quotation Request Form.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f699f8421d732c771c717001c87a7e88fdef3ad1fb0243d3ef2c3f29a29ec9ce/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 11:35:23 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=62m7qqq5omwhohdroaa4q6t6rd666owr7mbehu7pfq7stiu6zhha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f699f8421d732c771c717001c87a7e88fdef3ad1fb0243d3ef2c3f29a29ec9ce

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

cab f699f8421d732c771c717001c87a7e88fdef3ad1fb0243d3ef2c3f29a29ec9ce

(this sample)

Executable exe 8a07ebbecc711f77f14fa0a1902ddc74b3da8042500319b603754790b778caca

  
Dropping
MD5 6b7571a38e23526796ebd9c1bc7fcc1f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a07ebbecc711f77f14fa0a1902ddc74b3da8042500319b603754790b778caca

Comments