MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a93d2eb37111e07299399de80662b0e3dab80ec8441d0be707339fa2ccc9fdb3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a93d2eb37111e07299399de80662b0e3dab80ec8441d0be707339fa2ccc9fdb3
SHA3-384 hash: e5cf318ba5185ac226aaf33bdbbf349a43bd4b1693c047d8c0136522d77b1ec8c704c79d64d2fbbac1ac7dd23f038570
SHA1 hash: 6bb26a90ff72c7a087fae1d5ce30bb9ca736298d
MD5 hash: 2ac25ee4e29f70bec42d49b95996d94d
humanhash: xray-twelve-bakerloo-fanta
File name:Documents_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'570 bytes
First seen:2021-02-19 12:26:52 UTC
Last seen:2021-02-22 06:35:05 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:rI+HYDb42Kr3Dv2PM61qJhks9Lb4urKG784eE:k+HQb4hDv2L1qJhXLs6KG7n
TLSH 38842362A5ADA95F2F24C12C29F4F076752D34269DF011F0A03E65DBAF43E3256F62E0
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Muna Kinia <stikland2@bearings.co.za>" (likely spoofed)
Received: "from 107-174-142-107-host.colocrossing.com (unknown [107.174.142.107]) "
Date: "19 Feb 2021 13:21:37 +0100"
Subject: "SKM_36721012514070-2.pdf"
Attachment: "Documents_pdf.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a93d2eb37111e07299399de80662b0e3dab80ec8441d0be707339fa2ccc9fdb3/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-02-19 12:27:03 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ve6s5m3rchqhfgjztxuamyvq4pnlqdwiiqoqxzyhgop2ftgj7wzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a93d2eb37111e07299399de80662b0e3dab80ec8441d0be707339fa2ccc9fdb3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a93d2eb37111e07299399de80662b0e3dab80ec8441d0be707339fa2ccc9fdb3

(this sample)

AgentTesla

Executable exe 0c7c3ffd7b698b07d00bdad9377fd00b5dd6d853f06f670b63d6f082dac60391

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0c7c3ffd7b698b07d00bdad9377fd00b5dd6d853f06f670b63d6f082dac60391

Comments