MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48
SHA3-384 hash: 53c19dade7a35800aebe25863acf029b031ec865a712761671e16935ab56f9515ff904e83038b2fcd5f2b526ab533075
SHA1 hash: 059590e83e1fb27016d153fd1e12171763989111
MD5 hash: 8e2ba26163f471f18cab5ad50bbcd866
humanhash: april-seventeen-helium-seven
File name:RFL_058_13_72_06.R01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'767 bytes
First seen:2021-06-03 15:01:50 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 6144:F4Zev6duesx1UKY6scSLhEeFf/yX3fyZ4jHy66v6IDxd:acvJTx1U88EeFf/yX3fvL5iL
TLSH 5D542240E2BCE1DA83B5ED2F683C7D99AE79B2384DD8746D049B46FF53335E10960606
Reporter cocaman
Tags:AgentTesla r01


Avatar
cocaman
Malicious email (T1566.001)
From: "Philipp Schwizer<s.rashidli@mortelgroup.az>" (likely spoofed)
Received: "from hp0.209.cxvbnix.cf (hp0.209.cxvbnix.cf [159.203.161.137]) "
Date: "03 Jun 2021 10:40:26 +0000"
Subject: "Re: RFQ | SOA-TR-00621| PO order"
Attachment: "RFL_058_13_72_06.R01"

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-06-03 09:59:45 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
5 of 29 (17.24%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dmkvty4miuhxlsmbuiqfeyzpc5z6pd23grcgmctiuctxepgannea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 1b1559e38c450f75c981a22052632f1773e78f5b3444660a68a0a7723cc06b48

(this sample)

AgentTesla

Executable exe 4ff2f77293b6804df81124399a416b304d7e778e5c6157bf1bd90f6e011f06d2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ff2f77293b6804df81124399a416b304d7e778e5c6157bf1bd90f6e011f06d2

Comments