MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad
SHA3-384 hash: 9b1c1ef9e680eaf54f5576bbc8ac8e751588511f044677f3da0f2922218360723a79b665eff96b9aa7627f1e7f80a553
SHA1 hash: 23daa801fd4949dd5238f26931bbfd0c48660cd5
MD5 hash: f6cdaa147b1a34fe82896ea2a5a1f829
humanhash: edward-wyoming-five-lake
File name:PO P21050044.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:818'476 bytes
First seen:2022-05-16 11:15:25 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:kltfe5wo4CL6KsuLNc8pVyTuKvMwgBxK5k4jvrrI6pwPNJD99X2eQaIWNEKao8u4:Ee/Wlu9eTvMDBx2/jvevDa5a9EKa5df
TLSH T1D405233B9856C49F87026D9EE1BE5FA7166D0323A07D41B028A93527DE40E5B37EE31C
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email (T1566.001)
From: "hector.chavez@live.com.mx" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.130]) "
Date: "16 May 2022 13:14:21 +0200"
Subject: "Re: Purchase Order NO 832"
Attachment: "PO P21050044.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62823279fd71ca8b2ee4dd34/reports/986ef68f-5b8e-43c4-b33c-7d7eaf859d68/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-16 06:48:08 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
19 of 41 (46.34%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=usciwmpway6w3tr3eibxfrxcpag7ay6mz7ulpbmszaqqknjxuswq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad

(this sample)

AgentTesla

Executable exe ce260b263d3e127e5ba639e524279fe23ced619278013c8a740ae7a05cd5a55b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ce260b263d3e127e5ba639e524279fe23ced619278013c8a740ae7a05cd5a55b
  
Dropping
MD5 06dcb87bbe9870a849adfb167ff3ab0d

Comments