MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107
SHA3-384 hash: b71aa7474af8a2904fe79460f9e98f880fec73cc55704476141ddfb6718fdf0d4f12762124fc846e37033c2644741701
SHA1 hash: f2c532167c07a44679ea09c7741190248a07f32b
MD5 hash: f7073086c59e22d15959fcab66a82802
humanhash: muppet-skylark-video-mockingbird
File name:Signed PI April xlsx.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:524'043 bytes
First seen:2022-04-06 11:57:50 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:GdM3xfjLKlcFOpg4gx8Y5n1sajO6LmnfDOaW+8Vo0gK2pCg/xCv:pxfXR09gxTFSfa13gF/JCv
TLSH T105B423608D94B3E5CC331D82849C9F892290677DF7AF6B5350BCC45AE87763A9F2B910
Reporter cocaman
Tags:AgentTesla INVOICE r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Info@transamericatire.com" (likely spoofed)
Received: "from transamericatire.com (unknown [45.137.22.241]) "
Date: "06 Apr 2022 13:56:50 +0200"
Subject: "Signed proforma Invoice"
Attachment: "Signed PI April xlsx.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/624d804bdb9ca5cf842cc854/reports/ccba94ae-7fdd-463d-91d3-497cc84a5018/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-06 11:58:06 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
9 of 42 (21.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2es2mgqjd5mkzdnipm76pcm2ybhb2lchwlhtrke36v2uz2leedq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 a6892d30d048fac5646d43d9ff3c4cd60270e9623d9679c544dfabaa674b2107

(this sample)

AgentTesla

Executable exe 383fff675790452026d76d5459c6679d0f0c07d4cac361273e6ff82d5caedd5c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 383fff675790452026d76d5459c6679d0f0c07d4cac361273e6ff82d5caedd5c
  
Dropping
AgentTesla

Comments