MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49772ce34c8a4020d72326eb31c13c306111674e705b581414f7d56fa46849af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49772ce34c8a4020d72326eb31c13c306111674e705b581414f7d56fa46849af
SHA3-384 hash: 5fe5ba1f7872452888d30d9154efcf2c51ee6b0c21432dd146767c2962c93e60dce18bd1a0f8919a4a55daa6aaf6aa7c
SHA1 hash: 9983067f9e4767900a786ac636c7a4d928f6c2f5
MD5 hash: bd71cdc146f37901cafa2898a22573f9
humanhash: grey-sierra-emma-kitten
File name:bank draft copy.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:669'583 bytes
First seen:2020-09-01 06:48:21 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:jCtvf+WXso0tzAArqomqBeeq/8E0BeMbWG9055Nd0lBpaKzvQNHuXAUO1F:jCt2NrqR0E0LWG9nlDxQNRUCF
TLSH 34E423135C2BE8A3F40755C88ED175151CD1A9BBAF612C38F2D99F0A13254FA62632FB
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email
From: "Hunan Standard Steel" <ijayne@tswa.lk>
Received: from tswa.lk (unknown [212.7.204.179])
Date: 01 Sep 2020 06:35:32 -0700
Subject: Re: SWIFT Copies: Signed PI,& draft copy
Attachment: bank draft copy.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49772ce34c8a4020d72326eb31c13c306111674e705b581414f7d56fa46849af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-01 06:50:07 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jf3szy2mrjacbvzde3vtdqj4gbqrcz2oobnvqfau67kw7jdijgxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/49772ce34c8a4020d72326eb31c13c306111674e705b581414f7d56fa46849af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 49772ce34c8a4020d72326eb31c13c306111674e705b581414f7d56fa46849af

(this sample)

AgentTesla

Executable exe b903be7c680d5eb78f951c7e1743b53e0cdfae05e19fa6fe7e77c84c29df1156

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b903be7c680d5eb78f951c7e1743b53e0cdfae05e19fa6fe7e77c84c29df1156
  
Dropping
AgentTesla

Comments