MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b
SHA3-384 hash: 01612b01d74bbab0a675158969d0076b57125ed9e230c3f9696c0f797061990e0f316b3919cde6fe97e7272f78af6e63
SHA1 hash: ea9f300e4b8cc6b0364f7863c6673cb5ceaf0f09
MD5 hash: da05d11831b99295da1b3fd0287b0aca
humanhash: magazine-skylark-grey-steak
File name:QU0TA0076000000.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'229'143 bytes
First seen:2021-03-16 06:30:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:u1zX2I2jos4RPXhtfGYoF66DkspcBF2cSCX/9PgnEo3XBRW:u1zGI2jFoXXft+ohPSCX/9PBonLW
TLSH A84533C174153703DAD2DDF04D16CAB32117F02B89E0F6BB93AE864C455EC6A58FBA86
Reporter cocaman
Tags:img


Avatar
cocaman
Malicious email (T1566.001)
From: "comercializadora_br@outlook.com" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.58.152]) "
Date: "15 Mar 2021 20:51:24 -0700"
Subject: "=?UTF-8?B?55m856WoODkzNDU0LeW3peWFt+e2reS/ruacjeWLme+8jFNM?="
Attachment: "QU0TA0076000000.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.3467.13672.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Malware.Heuristic.1001.1954.20490.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Variant.Strictor.256884.21206.8036.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 06:31:06 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7adc9d4bba9cc9e033291a9da253ba1c8664858233dc326f3c20bd5d0a80c96b

(this sample)

AgentTesla

Executable exe 99e20e9f57324e56c59987b2d9778787c6db67693be34699a2968ec1120d2b47

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 99e20e9f57324e56c59987b2d9778787c6db67693be34699a2968ec1120d2b47
  
Dropping
SHA256 56d8a2469192ce83d332691cdeb0ba357c9dda7770e2b633a372beded0fce39a
  
Dropping
SHA256 f8b8baf52ce82465ea49e717204b3c9df9f0771d79ab7493a145895ab0328eb8

Comments