MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f
SHA3-384 hash:	dc29138f1fef52198afa960401900facccc22e0b92e82f76a7d58ca20c92d0ad8dd085ced69eddb36285c06e30328ee5
SHA1 hash:	0d958ffb16a33c89c541aa5c84ad76cd79a50cee
MD5 hash:	4393535fed10a33abcc36ff20415e247
humanhash:	alanine-carpet-fifteen-low
File name:	Mc6oZL4Bnwh83BX.rar
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	549'056 bytes
First seen:	2023-05-02 19:13:04 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:aSDYs6kWP7X/l/RK9q2cwbJ5m1RWGuYDrCB4XL:vYpPFRK9q29bARUYfCB4XL
TLSH	T1FCC423BE84799EB476B78348C5AFDB66FAFCB160106FAC38174BF10455E97622C32600
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	rar

cocaman

Malicious email (T1566.001)
From: "sales <sales02@mcconuogheylawfirm.com>" (likely spoofed)
Received: "from mcconuogheylawfirm.com (unknown [185.254.37.195]) "
Date: "Tue, 02 May 2023 07:19:11 -0700"
Subject: "old depth cleared and paid"
Attachment: "Mc6oZL4Bnwh83BX.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

153

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Int Remit TT copy.exe
File size:	784'896 bytes
SHA256 hash:	9eca24527414a8c5711c376502863053d89c0d82525cfd1dc98a6364975107bc
MD5 hash:	719db535617887ab0338a39339ff5cab
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

barys comodo lokibot packed

Link:

https://www.filescan.io/uploads/645160fb1facab193c671c89/reports/c74301cc-4d0a-4a69-bd6b-f0eef1c315c2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2023-05-02 19:14:08 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 37 (16.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cvp2h37zgpnbisija77tbhgp7eqqahwa7b27hqr5pjwporgimfhq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/155fa3eff933da14490907ff309ccff921001ec0f875f3c23d7a6cf744c8614f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.