MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d949763816f84af3a354a40587b221658690a6ec71532b43c77075f6ba8d358. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d949763816f84af3a354a40587b221658690a6ec71532b43c77075f6ba8d358
SHA3-384 hash: fd719aecbfa3294000d8d9a77efe966c3a0063dfcf1cc3f89a3475468d35940a74bc3397e53646846838055d47bdb484
SHA1 hash: a51909dd48ff54a47d0e1cbd869be4919130e963
MD5 hash: 21a3619113af6a07dc2e51a38090ac36
humanhash: mexico-batman-alabama-hawaii
File name:New Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:747'687 bytes
First seen:2020-11-04 12:00:16 UTC
Last seen:2020-11-04 12:23:18 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:OKFc53CMe+CE+x3PFPfj+YwJE9xNn60sCa7P+gpf8FO24KWW9bp+Jv:BFc0Me+w3Xz0ET8bCyTpfub4KlbkJv
TLSH 8CF433726BD8367C7E5EA54B3DA217D4D0C6463EFBB926B0BFC84C80666466C0013F0A
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d949763816f84af3a354a40587b221658690a6ec71532b43c77075f6ba8d358/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 14:23:39 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fwkjoy4bn6ck6orvjjafq6zcczmgsctoy4ktfnb4o4dv625i2nma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2d949763816f84af3a354a40587b221658690a6ec71532b43c77075f6ba8d358

(this sample)

AgentTesla

Executable exe 10bd64efbdb93ad3b777edc550b0d16bbaee95d365541937c1bb4a5a305683b7

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10bd64efbdb93ad3b777edc550b0d16bbaee95d365541937c1bb4a5a305683b7
  
Dropping
MD5 f6e2d909a32abf71e24bd45c7c2e2dbb

Comments