MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65ca2b38961fcbe3934e404518a1b582167e14d519e4b652ce3ef0b061716f52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65ca2b38961fcbe3934e404518a1b582167e14d519e4b652ce3ef0b061716f52
SHA3-384 hash: d7a0d6766b7a346be6aec347eb523846834734b7d4391c7ae5ce710da16910bfa369988f5267fe5fc7288273cdf37ea3
SHA1 hash: 600ea2157254ce33952330e240dec6c2fe7b7d90
MD5 hash: 7f3791ec9832fbdf4b1199c28b1b0707
humanhash: butter-green-pizza-nitrogen
File name:HaeKeon RFQ 08-00820.pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:268'161 bytes
First seen:2020-08-05 08:49:24 UTC
Last seen:Never
File type: r00
MIME type:application/gzip
ssdeep 6144:jKCvmzIf7SvpJLNRWk/HKIl39qdBlNF9OvU8T5JKGDEasxkMM:jlmzoyp1NjqIOdBlv9Ov7rykP
TLSH 29442373C971221AA6AC499566E83C716D8218CCA54E723293BC7D14E1F8BDDF478ECC
Reporter abuse_ch
Tags:AgentTesla Hostwinds r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-759095.hostwindsdns.com
Sending IP: 104.168.132.168
From: Seo-hyeon young <s-hyeon@haekeoncorp.co.kr>
Subject: HaeKeon RFQ
Attachment: HaeKeon RFQ 08-00820.pdf.r00 (contains "HaeKeon RFQ 08-00820.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65ca2b38961fcbe3934e404518a1b582167e14d519e4b652ce3ef0b061716f52/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:51:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxfcwoewd7f6he2oibcrrinvqilh4fgvdhslmuwoh3ylaylrn5ja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/65ca2b38961fcbe3934e404518a1b582167e14d519e4b652ce3ef0b061716f52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 65ca2b38961fcbe3934e404518a1b582167e14d519e4b652ce3ef0b061716f52

(this sample)

AgentTesla

Executable exe de79ac00f59dfdffc37abc93524e329d5a48f6bd3f3ea5fec5df264e08d4a6a3

  
Dropping
MD5 dfd5f2a70c0d088b9bc934e2ff1531df
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de79ac00f59dfdffc37abc93524e329d5a48f6bd3f3ea5fec5df264e08d4a6a3

Comments