MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 159e22e95c5dc02e378a4e1ce7fdac6e94b6d2afc40614a8e476658374802ccd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 159e22e95c5dc02e378a4e1ce7fdac6e94b6d2afc40614a8e476658374802ccd
SHA3-384 hash: 6bd21926cfc1e83b33559337e111f33580bd247f7d2fdb04434f1043791da8767779ff68b4ce9e13ec1a9991f5e28165
SHA1 hash: 5e2562eea8ccbc1c8077080136e36ab881ae6536
MD5 hash: 9316d9cb9b0925ad538c6037a2e55c4f
humanhash: pip-earth-carolina-idaho
File name:REVISED PROFORMA INVOICE.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:791'900 bytes
First seen:2021-01-25 06:22:47 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Y9LEevLLA8TNWwq0tzUnmgyJPBdRiInFL6LGmbn0HlliwL71j6WQATPTbnb:YREejLIAUnmgyn9FeL6Hr7hPTzb
TLSH 7CF42360EFC1B82232C12542F897D5DB5B00D152975EBE190AB13A463E9734F8B2DEF9
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?QWxlamFuZHJhIETDoXZpbGEgPA==?= adavila@saconvenciones.com.mx >" (likely spoofed)
Received: "from saconvenciones.com.mx (unknown [185.222.57.135]) "
Date: "24 Jan 2021 20:07:33 -0800"
Subject: "RE:REVISED PROFORMA INVOICE"
Attachment: "REVISED PROFORMA INVOICE.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20210125-0747.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/159e22e95c5dc02e378a4e1ce7fdac6e94b6d2afc40614a8e476658374802ccd/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-25 00:30:26 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwpcf2k4lxac4n4kjyoop7nmn2klnuvpyqdbjkheozsyg5eaftgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/159e22e95c5dc02e378a4e1ce7fdac6e94b6d2afc40614a8e476658374802ccd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 159e22e95c5dc02e378a4e1ce7fdac6e94b6d2afc40614a8e476658374802ccd

(this sample)

AgentTesla

Executable exe 92d887eebd56236c7b64d7c4df54d34b63910982eddf27769b942d524c39a4a3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92d887eebd56236c7b64d7c4df54d34b63910982eddf27769b942d524c39a4a3
  
Dropping
AgentTesla

Comments