MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0631c94fdd37b2e9af70b63823006bbc36487870633683e797790fc64d20ab7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0631c94fdd37b2e9af70b63823006bbc36487870633683e797790fc64d20ab7f
SHA3-384 hash: 2b7892ec1bfc29ac4e3e031612be976b7ad3e1d4feb97c7f3929b80dbfd734e8f66df0cf20d9d3dcf1b88fdec7249ac8
SHA1 hash: e21bff6646955b10bb86077ed1e3e7ca979d9c1f
MD5 hash: e9de5d3d36234bff708f1dd785b25571
humanhash: ack-orange-five-north
File name:Confirmation Letter.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:449'735 bytes
First seen:2020-05-26 06:00:53 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:6BynkAc10HRgBhYky/+riBTMJjM/nDXD28KZtiDsPBEBD:6BynZY0xgBhwTBMy/DXDUz5Pu
TLSH 1FA4231E349454407EAD076980AE35673E354BDDF013EBAAC85A9DA20AEFC163F1C5F2
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email
From: Shokhrukh kurbanov <kurbanov@heinemann-ent.de>
Received: from heinemann-ent.de (unknown [199.96.83.18])
Date: 25 May 2020 20:57:20 -0700
Subject: RE: Safety Products Distributor Confirmation
Attachment: Confirmation Letter.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:37:28 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
13 of 30 (43.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 0631c94fdd37b2e9af70b63823006bbc36487870633683e797790fc64d20ab7f

(this sample)

AgentTesla

Executable exe 46f77e69d710a9b85bbc8484b9d4149cce5d29d1e2fe102170c637f75c93e362

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46f77e69d710a9b85bbc8484b9d4149cce5d29d1e2fe102170c637f75c93e362

Comments