MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b03468b8b4c5f5314fad4fe0890919034dc6774442c5e5463d76e30707d6d29c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b03468b8b4c5f5314fad4fe0890919034dc6774442c5e5463d76e30707d6d29c
SHA3-384 hash: 6e5174dfd9a0c4dd5b4a2c758ef2927dab181959332b168bf6e91264452b2903264a66a10d0410bff7ad8c5f473b4ddc
SHA1 hash: 0760d8fb58af5a72ba8c6f755e09b39c8133ac0c
MD5 hash: ee3ae37c644e5c65944508a4ec400122
humanhash: triple-sweet-nineteen-december
File name:REVISED_EPDA _ Statment & Tuticorin MV GRACE.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:359'909 bytes
First seen:2021-02-09 06:20:13 UTC
Last seen:2021-02-09 12:12:54 UTC
File type: r01
MIME type:application/x-rar
ssdeep 6144:XZSzA2O9+FvmjOQmgCwPSgnhY+KOgXx7cMR0hpNjIqRcVWkw:XZS8jMedp3dKOgRcMSpNjXOu
TLSH 4874235651F10F1E1ECC2037C51B10EC972E6EC8ABABBAC67A36F61960542D3C8CE274
Reporter cocaman
Tags:AgentTesla r01


Avatar
cocaman
Malicious email (T1566.001)
From: ""Phaz M.Blay" <pmblay@foscon.com.ph>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [185.222.57.246]) "
Date: "9 Feb 2021 02:16:52 -0800"
Subject: "AW: RI: Revised EPDA & Overdeu Statement for Tuticorin MV AGENCY GRACE."
Attachment: "REVISED_EPDA _ Statment & Tuticorin MV GRACE.r01"

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20210210-0758.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b03468b8b4c5f5314fad4fe0890919034dc6774442c5e5463d76e30707d6d29c/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 06:21:09 UTC
File Type:
Binary (Archive)
Extracted files:
71
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wa2grofuyx2tct5nj7qiscizang4m52eilc6krr5o3rqob6w2koa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b03468b8b4c5f5314fad4fe0890919034dc6774442c5e5463d76e30707d6d29c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 b03468b8b4c5f5314fad4fe0890919034dc6774442c5e5463d76e30707d6d29c

(this sample)

AgentTesla

Executable exe 0b3369216c127cc53e7c1050cc5e240101c1282ca0c0bf974f7e1c3be0009cca

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b3369216c127cc53e7c1050cc5e240101c1282ca0c0bf974f7e1c3be0009cca

Comments