MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a
SHA3-384 hash: 1da939fe8f3aebd33b5f4f11699c6e2a3e361f849f5279de94c0fdc071f881c47aa73cf2ab438f8f277928cbbf6636e4
SHA1 hash: 339d75de69b03fb504bbf22df6b70a86db8d5ca9
MD5 hash: 341f36724c7fd6d7fcf4b00bba88a56b
humanhash: mountain-august-mississippi-juliet
File name:IMG_6050_710_33.R03
Download: download sample
Signature AgentTesla
Create hunting rule
File size:312'743 bytes
First seen:2021-05-07 16:44:18 UTC
Last seen:2021-05-07 18:02:39 UTC
File type: r03
MIME type:application/x-rar
ssdeep 6144:+9niAA1q73Eh1Zem4pSHubZUA1QaKlU/eHYltBv7q8ZViKRbgEKaZOvw07pHm:Hn1q7+0r0HuNFQ+/e6aYb3KaZewypG
TLSH 9B6423864D66395D05E7E424AF9202214B04EA1FDF9F884C9D6F7A8EC33D4EDABC254C
Reporter cocaman
Tags:AgentTesla r03


Avatar
cocaman
Malicious email (T1566.001)
From: ""Omar Baddar" <postmaster@allstew.com>" (likely spoofed)
Received: "from slot0.allstew.com (slot0.allstew.com [185.121.120.159]) "
Date: "Fri, 07 May 2021 16:35:21 +0200"
Subject: "RFQ-50236710-ETECSA"
Attachment: "IMG_6050_710_33.R03"

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-05-07 16:45:15 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vvgg24hihm3i2tygblpdm7eclbhaak4a43wibyts27nbgahd7ena._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r03 ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a

(this sample)

AgentTesla

Executable exe c3bf2dd2d53f2ac2dcf5e59aa8d234efdf24fb7f5eca9e2a9cb1a4536979bed4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3bf2dd2d53f2ac2dcf5e59aa8d234efdf24fb7f5eca9e2a9cb1a4536979bed4
  
Dropping
AgentTesla

Comments