MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7eb45a4c4b6a9eb7033abc02cdd62b6d9496d22b4ac465b3be38c7e6531bd2d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7eb45a4c4b6a9eb7033abc02cdd62b6d9496d22b4ac465b3be38c7e6531bd2d2
SHA3-384 hash: 5bd462a58c0d64628869ff02e41ab0ee3e831e9788bd7813c370e14ac308c6d323a9492bce47572476611c768c22030d
SHA1 hash: eb0c4187e33433bf4e0ecf31ff4169717decc8b1
MD5 hash: 0bd98eb827b668a5bdb27eb6a790364b
humanhash: steak-ten-oklahoma-violet
File name:70654 SSEBACIC INDIA.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:657'153 bytes
First seen:2021-03-18 06:19:34 UTC
Last seen:2021-03-18 06:20:23 UTC
File type: r00
MIME type:application/x-rar
ssdeep 12288:kmRogfgvL3E25MZofBQ4B9IQt27/SR5/eqzZKy3d3l394eL61Y4K2kep34fpykE:5/JaF6W27aRvK63l394vO42epIfAJ
TLSH 1DE423D08F42A5D9A3FD8253DB41E08AE4D4CE1BF9AC5C445C2A9C54A91E9FE42B331F
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "rishav.pokharel@pkf.com.np" (likely spoofed)
Received: "from pkf.com.np (unknown [185.222.57.157]) "
Date: "17 Mar 2021 18:06:27 -0700"
Subject: "Urgent Inquiry For required quotation for 511 projects Purchase Order -S0004PO-0068663"
Attachment: "70654 SSEBACIC INDIA.r00"

Intelligence

File Origin
# of uploads :
3
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7eb45a4c4b6a9eb7033abc02cdd62b6d9496d22b4ac465b3be38c7e6531bd2d2/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-17 23:20:08 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p22futclnkploaz2xqbm3vrlnwkjnurljlcglm56hdd6muy32lja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/7eb45a4c4b6a9eb7033abc02cdd62b6d9496d22b4ac465b3be38c7e6531bd2d2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 7eb45a4c4b6a9eb7033abc02cdd62b6d9496d22b4ac465b3be38c7e6531bd2d2

(this sample)

AgentTesla

Executable exe 98f00496b7cd4b18ed2290eb106fed45245feb53c36785c46a6c9ae5057a75a6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98f00496b7cd4b18ed2290eb106fed45245feb53c36785c46a6c9ae5057a75a6

Comments