MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906
SHA3-384 hash: b07e4df028d4de24157382ec4232e25e48c6f21adc5a086bce2634ae1878bc4ba4633980cca9a865203950b7b34bd833
SHA1 hash: dc0fb8389bc1721c899575a5d51638fb7b5638ba
MD5 hash: d18408259775442e03bb7eb9b7a74bb9
humanhash: sink-oregon-video-skylark
File name:Proforma Invoice No. 14214.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:707'652 bytes
First seen:2021-06-11 06:17:19 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:IuA+hzn2yaxkcSWm0t/C4y8912AidXjnAJ/0f8E/42j4tBhtw+iHlPcA1nm+f:Q+hn4Lt9C4y8919iljAR0kEQDtvtwHH9
TLSH 07E423A7D84B6446DF823CF26F400AB98E9EE8F53315CCDA4505C49621AE3FDBB4462D
Reporter cocaman
Tags:AgentTesla INVOICE r00


Avatar
cocaman
Malicious email (T1566.001)
From: ""Jong, Alice" <alice.jong@corbion.com>" (likely spoofed)
Received: "from corbion.com (unknown [185.222.57.244]) "
Date: "10 Jun 2021 22:12:49 -0700"
Subject: "Shipping Doc ... RE: Revised Shipment details OA 14214 - LC Cable for Proforma Invoice No. 14214"
Attachment: "Proforma Invoice No. 14214.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 01:35:26 UTC
File Type:
Binary (Archive)
Extracted files:
35
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6dwoyxiwndn6wm35rjznwrmxl37w4jdnqxhpbint3n242vj5eda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906

(this sample)

AgentTesla

Executable exe 70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84

Comments