MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fc8fa0bab08c89cef51dffd3667921e8b34623b4161623c9cd72111768a0ecb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fc8fa0bab08c89cef51dffd3667921e8b34623b4161623c9cd72111768a0ecb
SHA3-384 hash: 256a4c333ec78e1448591d67b554178370a8dc5993c15f236638f4ae876252d1ad641dfcfea72391ab7cab11e073e4e9
SHA1 hash: dd6c25d563937aeaa0c862ca5066b685eebf7239
MD5 hash: c6dd2941d20047407ff8ae23abd02440
humanhash: maine-failed-neptune-fanta
File name:PRODUCT SPECIFICATION.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:354'664 bytes
First seen:2020-10-28 06:34:22 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:LHSQswzvXret8JyZdPPDS4MWvWf01ionKw8MX9tNgj/:LHSJwzvXIj+hc7yy9YD
TLSH 097423854BB7AA78C7F3406091AC9A76ACB3C803111E475476689DF1BF1C4A3F91B8B7
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "DAEHWA E/M CO.,LTD <edward@daehwagm.co.kr>"
Received: "from daehwagm.co.kr (hwsrv-786782.hostwindsdns.com [192.119.92.163]) "
Date: "27 Oct 2020 19:10:01 +0000"
Subject: "DAEHWA ENTERPRISES TRADE RFQ"
Attachment: "PRODUCT SPECIFICATION.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fc8fa0bab08c89cef51dffd3667921e8b34623b4161623c9cd72111768a0ecb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 15:01:14 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7epuc5lbdejz32r376tmz4sd2ftiyr3ifqwepe424qrc5ukb3fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4fc8fa0bab08c89cef51dffd3667921e8b34623b4161623c9cd72111768a0ecb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 4fc8fa0bab08c89cef51dffd3667921e8b34623b4161623c9cd72111768a0ecb

(this sample)

AgentTesla

Executable exe 91b511bb7a9d86543503ce39dbda14d12f86d8d704a7e97c070356a182902bf7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91b511bb7a9d86543503ce39dbda14d12f86d8d704a7e97c070356a182902bf7
  
Dropping
AgentTesla

Comments