MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95
SHA3-384 hash: 48e44651b935e3da300b3aeeab836460a4d028e060454b676be8323bdd1d1c97bfa5e231f2080a4fc3482d2188eff453
SHA1 hash: 41ac68907683a644a085b08441498726792bd5ff
MD5 hash: c6acecd5b217562bf8a1bb4d47923569
humanhash: football-alanine-william-nevada
File name:Purchasing FOOD STUFF.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'708 bytes
First seen:2021-07-18 07:07:31 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:s9QNNpWkxqVY6AG/Fq7bBONHB1TNBgbDp9YTo5C5bQhiqPIp3o:s9xkxQ/dKBOhBTBvTo5C5bQhfIp4
TLSH T13DB433F509CE4D81D10396A7172A5854AAABCE93DB2870F0E5D7250ECE47E337819F72
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Info Info<info@haks.co.in>" (likely spoofed)
Received: "from haks.co.in (unknown [185.222.57.75]) "
Date: "18 Jul 2021 03:48:25 +0200"
Subject: "RE: AW: Open the file and see Enquiry for Purchasing itens"
Attachment: "Purchasing FOOD STUFF.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-18 03:31:58 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=grsd2z7ahpyguou36zljasojcnkurrhwc2k2r4i656rs66ardokq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95

(this sample)

AgentTesla

Executable exe eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0

Comments