MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d436461a50b540c18045007d481c7b809ea3479d934aff57929eb149b410ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99d436461a50b540c18045007d481c7b809ea3479d934aff57929eb149b410ac
SHA3-384 hash: bf477ec63ad986c829e89e43a7916603172242687a2ced0814068d372fd91bacdbd2df1b35390e7a80cf7350ffac75dc
SHA1 hash: 7815a18852eadddc604ba15b704c76636d73d29a
MD5 hash: 4b710588b35829d3dfe35ecfbe9329fa
humanhash: mango-green-failed-papa
File name:DOC764485647465845.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:278'142 bytes
First seen:2020-10-06 06:11:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:egmbf/LfyxeFBVBYiNY2qMQhLmevbLfJKfUYMQIYvdSOY1a:1sraxeFykYTmCLfJZ9CdSOY8
TLSH 9844237232AA24FEC099DF5B65D1F430FC8E128FE98B82505B61F6976947005F72D8A3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: awef0.elno.gq
Sending IP: 159.89.1.102
From: Kohei Tokushige <Kohei@elno.gq>
Reply-To: Kohei@elno.gq
Subject: Inquiry
Attachment: DOC764485647465845.rar (contains "DOC764485647465845.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99d436461a50b540c18045007d481c7b809ea3479d934aff57929eb149b410ac/
Threat name:
ByteCode-MSIL.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 03:22:17 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=thkdmrq2kc2ubqmaiuah2sa4poaj5i2htwjuv72xskplcsnuccwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99d436461a50b540c18045007d481c7b809ea3479d934aff57929eb149b410ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 99d436461a50b540c18045007d481c7b809ea3479d934aff57929eb149b410ac

(this sample)

AgentTesla

Executable exe dea17105c3a10735f37a3e65de25213d19e3f936e4bc88da33116921769a9831

  
Dropping
MD5 fa279880c96b904a8041c36eabad8b1c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dea17105c3a10735f37a3e65de25213d19e3f936e4bc88da33116921769a9831

Comments