MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fd118b9c5e6a1cb8f1c7dda18946d80eb88c3991b1495d4ee3b0191b8145f67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	6fd118b9c5e6a1cb8f1c7dda18946d80eb88c3991b1495d4ee3b0191b8145f67
SHA3-384 hash:	ba6ce46ac675e2f6bdb11ab15e96a043f0ad415723c995e1e4d80ee285cb419af64d3ca8a6d2d0112a3c79c5b89e0db2
SHA1 hash:	614039f51354c35c2edd05569862086b218098fe
MD5 hash:	ab1de42f6fbea905f2c10b996d362e26
humanhash:	green-golf-lemon-speaker
File name:	PO-SB-2324-4240425.r00
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	564'201 bytes
First seen:	2023-07-07 08:41:38 UTC
Last seen:	Never
File type:	r00
MIME type:	application/x-rar
ssdeep	12288:ZvTckAGoQK/e1hOTAP5DE25by1ciO5Zm7LDd2UzknVpmv7mlf:1wnnshOcCf1IZm7LFRzmlf
TLSH	T16DC4230D40A1BE0A7570B94D441C7299A0CBBD1C9E3BF872C9D9AFA2F7976A022543DD
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla r00

cocaman

Malicious email (T1566.001)
From: "smugreski.t@elte-inzenering.com.mk" (likely spoofed)
Received: "from elte-inzenering.com.mk (unknown [45.137.22.243]) "
Date: "07 Jul 2023 10:41:07 +0200"
Subject: "PO NO. PO-SB-2324-4240425"
Attachment: "PO-SB-2324-4240425.r00"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	grace.exe
File size:	911'872 bytes
SHA256 hash:	c6e20af2fcd85eb6d5091e3fae90a2cd37ebc6ff0be026d1cf097df5b4c7bc3b
MD5 hash:	4de0a713f8a265ceb7835013999c5639
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20230707-1034.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/64a7cfda8583eaadb34f5e69/reports/baa2c2cc-854f-4b49-a072-11d1dceb9bb5/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6fd118b9c5e6a1cb8f1c7dda18946d80eb88c3991b1495d4ee3b0191b8145f67

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6fd118b9c5e6a1cb8f1c7dda18946d80eb88c3991b1495d4ee3b0191b8145f67/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2023-07-07 00:56:06 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 37 (45.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n7irroof42q4xdy4pxnbrfdnqdvyrq4zdmkjlvhohmazdoaul5tq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.96

Link:

https://yomi.yoroi.company/submissions/6fd118b9c5e6a1cb8f1c7dda18946d80eb88c3991b1495d4ee3b0191b8145f67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.