MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 626a7cd7eb6f9be62bb16ea594a0a9ddc767ced009f1b5b38aa47085e2dff4f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 626a7cd7eb6f9be62bb16ea594a0a9ddc767ced009f1b5b38aa47085e2dff4f0
SHA3-384 hash: adb7559dedc6d0d7843e8cf956ebb6297631d386546dd347099a4bcba488333e785b91aa56f6d9baa5093f15f6055c32
SHA1 hash: e239d594ff227addd6a9e228909137dbe9d2fcd4
MD5 hash: 601f6b2c3d9afc102f34fa830668286a
humanhash: harry-bakerloo-equal-twelve
File name:LT Panels & Bus-duct COPY.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'499 bytes
First seen:2020-07-23 11:54:40 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:0kHBG5YPpMzsq7KF1YNNoh2/biTQAA+/e1deIPN0pMs0NSCmFkOEchcv6M:0khw3zjKVm2A+m1nN8zGjVO3hciM
TLSH 689423202CA852A7A6D21EDDB5EEA4B9E1C4F5443E558F193EECC5FF3FCA6096484204
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email
From: "Rosette de la Vina" <rv@act-me.com>
Received: from act-me.com (unknown [37.48.85.242])
Date: 23 Jul 2020 11:01:36 -0700
Subject: Re: Final discounted price-LT Panels & Bus-duct
Attachment: LT Panels & Bus-duct COPY.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/626a7cd7eb6f9be62bb16ea594a0a9ddc767ced009f1b5b38aa47085e2dff4f0/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 11:56:06 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mjvhzv7ln6n6mk5rn2szjifj3xdwptwqbhy3lm4kuryilyw76tya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/626a7cd7eb6f9be62bb16ea594a0a9ddc767ced009f1b5b38aa47085e2dff4f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 626a7cd7eb6f9be62bb16ea594a0a9ddc767ced009f1b5b38aa47085e2dff4f0

(this sample)

AgentTesla

Executable exe 9ed8b4aa4693089d71da648dcc5a33cb2263d82cd522140e063d3150747a2f6d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9ed8b4aa4693089d71da648dcc5a33cb2263d82cd522140e063d3150747a2f6d
  
Dropping
AgentTesla

Comments