MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 622f5ae703fa719ac57b3095c4cdeeae8339fd475f9437e298bdf79e559136b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 622f5ae703fa719ac57b3095c4cdeeae8339fd475f9437e298bdf79e559136b3
SHA3-384 hash: 6c71fe534c25fb5a0969c213b298278c064f5fe123ef73a2e28ca30605d90383f7b19c7ec2dc6f58c0c5872ce5bf6ba1
SHA1 hash: 75918564083351a5b57daa2773e2e4687a9d7b7c
MD5 hash: c6286dba2599c1bec96b10180b7a4a92
humanhash: twelve-gee-california-august
File name:urgent new PO 14172202.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:569'812 bytes
First seen:2022-05-17 08:25:30 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:HeOBMzux1kxe9txvfYWS9xq2B3LrQY3CYboIpilE57VTGpSyziRFHUggEpC8iue7:+66ux1koXSrqWPnCVIpi3ziTH/Vw8g
TLSH T131C42321DBF19479BECF452DB7DB157B2D6C3B8A8312129102FD6B34BD2DB1094AB181
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Shaikh Fahim <fahim@alnahdhagroup.com>" (likely spoofed)
Received: "from alnahdhagroup.com (unknown [45.137.22.135]) "
Date: "17 May 2022 02:50:03 +0200"
Subject: "urgent new PO"
Attachment: "urgent new PO 14172202.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe update.exe
Link:
https://www.filescan.io/uploads/62835c3bfd71ca8b2eea2ca5/reports/065135d4-7c42-415b-ae19-88e8936882ff/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/622f5ae703fa719ac57b3095c4cdeeae8339fd475f9437e298bdf79e559136b3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-17 08:26:09 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
10 of 41 (24.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mixvvzyd7jyzvrl3gck4jtpov2btt7khl6kdpyuyxx3z4vmrg2zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/622f5ae703fa719ac57b3095c4cdeeae8339fd475f9437e298bdf79e559136b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 622f5ae703fa719ac57b3095c4cdeeae8339fd475f9437e298bdf79e559136b3

(this sample)

AgentTesla

Executable exe a1d01c0e1a1d513991939e0a16abc25ed3927f78102a24b6af85f09fbfb27567

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a1d01c0e1a1d513991939e0a16abc25ed3927f78102a24b6af85f09fbfb27567
  
Dropping
MD5 def202a9fcb3bd58c075468a402bd879

Comments