MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d652104f1c6f89b9ab77d921251b3a6db8a2bc190957bf7a594fcc6c7b809bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d652104f1c6f89b9ab77d921251b3a6db8a2bc190957bf7a594fcc6c7b809bd
SHA3-384 hash: fb589c31b04ee4d37c1448b3beca4e73c70bcc9b2cab34075561781af7c86f0af7d7cad5e22e7dcd98b91cb8e9c8ee83
SHA1 hash: 5dd51998b3b9ef055c722beca3cac62eacac168d
MD5 hash: 0973f3c17ccca049091adb38227c060d
humanhash: floor-mountain-delta-saturn
File name:AWB draft.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:376'756 bytes
First seen:2022-01-31 01:48:11 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:gX+njivDHBgoXdjQgqoXCYl6NOnEC6oI39WdMHiprQHN8ynFij0MWs+e0cCRjhcy:8C+HykQgqopl6NOnDI34zOHN8yn8j0Me
TLSH T14F8423260337D5907E380B11ED1A846E98E1083AB62DFE5C35B23B8D1B253B9DA773D5
Reporter cocaman
Tags:AgentTesla INVOICE r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Cargomar Kochi Air Ops <kochiairops@cargomar.in>" (likely spoofed)
Received: "from smtp-gw.fpcci.org.pk (smtp-gw.fpcci.org.pk [124.29.202.102]) "
Date: "Mon, 31 Jan 2022 02:47:19 +0100"
Subject: "Re: INVOICE 7046 / AWB draft"
Attachment: "AWB draft.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61f7400ffc92af0d80a6ac66/reports/54d50524-b338-49b9-a171-fe249cf365cf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d652104f1c6f89b9ab77d921251b3a6db8a2bc190957bf7a594fcc6c7b809bd/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 01:49:11 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
7 of 43 (16.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvsscbhry34jxgvxpwjbeuntu3nyuk6bsckxx55fst6mnr5ybg6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d652104f1c6f89b9ab77d921251b3a6db8a2bc190957bf7a594fcc6c7b809bd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 5d652104f1c6f89b9ab77d921251b3a6db8a2bc190957bf7a594fcc6c7b809bd

(this sample)

AgentTesla

Executable exe eaa778e836807d3c7dc4198eb7b0aec0d7de4a11ab1e2b6764b17ac0fd907afd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eaa778e836807d3c7dc4198eb7b0aec0d7de4a11ab1e2b6764b17ac0fd907afd

Comments