MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8007229163088e9a2f7591fdf2b242e8231d203ed8bbbdebe1c1a821f0ef0da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8007229163088e9a2f7591fdf2b242e8231d203ed8bbbdebe1c1a821f0ef0da
SHA3-384 hash: aea957de0d076360a9572c7be668a5489113aa6a8342e5c5558ed2ab70b85f308dc7d1db5b08a07c2fd23c14b1e58639
SHA1 hash: c741705c85816fb87dfcbb540183b3691cc1e88c
MD5 hash: 2416d6ed4a789ef5066c18b68e0a70c2
humanhash: two-victor-idaho-alabama
File name:BOQ Project Tender Ref RFQ No 453793420.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'008 bytes
First seen:2020-08-04 07:39:33 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Shx+3yY/jODlpV0JfzYiHjWBAmDG+Tkie:Shx5YbEpyZsWqBAyTJe
TLSH 0194230D67C1A033C9DEABB43016D85B636796C9C28DE0EAC4EBE76E44FA9453D7D006
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: www.atecyr.org
Sending IP: 94.177.185.236
From: Lenny Mantiri <lenny.mantri@archimining.com>
Subject: TENDER REF NO : 453793420: RFQ - FOR SUPPLY OF LUBRICANT OIL, STORAGE TANKS, MACHINERY AND EQUIPMENTS(M&E) FOR REFINERY PROJECT IN BONTANG, INDONESIA
Attachment: BOQ Project Tender Ref RFQ No 453793420.r00 (contains "Refinery Project BOQ_Compliance data sheet No 453793420.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8007229163088e9a2f7591fdf2b242e8231d203ed8bbbdebe1c1a821f0ef0da/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:41:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7aahekiwgceotixxlep56kzef2bdduqd5wf3xxv6dqniehyo6dna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f8007229163088e9a2f7591fdf2b242e8231d203ed8bbbdebe1c1a821f0ef0da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 f8007229163088e9a2f7591fdf2b242e8231d203ed8bbbdebe1c1a821f0ef0da

(this sample)

AgentTesla

Executable exe 920793d133d7ad17ee4d14870e23dfba742ecd19e45a8a0c3e1105605b71cc8e

  
Dropping
MD5 1d64d2c55eea76e69877f10e0c25eb79
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 920793d133d7ad17ee4d14870e23dfba742ecd19e45a8a0c3e1105605b71cc8e

Comments