MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97f0dc5d6cccc16d4e147799580d302b3c2236433f3973451b31f8d8139a0bba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97f0dc5d6cccc16d4e147799580d302b3c2236433f3973451b31f8d8139a0bba
SHA3-384 hash: 0b2d78aa3b7ee2522f7184faf1f9b40a8dcdeef505654f65953acaeafb0bb71771c10f1f4c35f52820c4e1bd144a0dec
SHA1 hash: 802327dc227c96cea288c12cffa2478eea7c5d9c
MD5 hash: e31312c6e1e07113ec617791060f2f20
humanhash: vegan-wyoming-hawaii-delta
File name:Arrange Charge.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:582'514 bytes
First seen:2021-06-19 05:11:45 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:TnZCHUORSvaDtA5J2n0GLNCh2J2KfqQdMJ7fIFyEgY:TZV85A5Jm0ECh2GS0bI
TLSH A7C423A388F6FDBC3E2EBCEEC6418C41AD53BBAB1B55E5E4992251105D34270F290F91
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Scotsman Guide <Originator@scotsmanguide.com>" (likely spoofed)
Received: "from scotsmanguide.com (unknown [84.38.130.222]) "
Date: "18 Jun 2021 21:01:03 +0300"
Subject: "Re: Arrange Charges In The File"
Attachment: "Arrange Charge.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97f0dc5d6cccc16d4e147799580d302b3c2236433f3973451b31f8d8139a0bba/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2021-06-19 05:12:10 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
12 of 46 (26.09%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7ynyxlmztaw2tquo6mvqdjqfm6censdh44xgri3gh4nqe42bo5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97f0dc5d6cccc16d4e147799580d302b3c2236433f3973451b31f8d8139a0bba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 97f0dc5d6cccc16d4e147799580d302b3c2236433f3973451b31f8d8139a0bba

(this sample)

AgentTesla

Executable exe 54d85531b7e4974b1648d7a95ee215e297632fbc2879cc5248fbbc29243d54fb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 54d85531b7e4974b1648d7a95ee215e297632fbc2879cc5248fbbc29243d54fb

Comments