MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3e7d6f76b1b290057134c91556252310fddab14cc08fea5470de10957822e6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3e7d6f76b1b290057134c91556252310fddab14cc08fea5470de10957822e6d
SHA3-384 hash: 519be16aadc3352caedad7015f9f3453716bce34ac79b8531e91729b8202b73e08774eb1c58813d36fdd859cfce97fad
SHA1 hash: 525f6c59a5d8231f9f4c7c3cdf43ea20787fdccd
MD5 hash: b7746a46f25925be882618956876e047
humanhash: connecticut-sodium-west-don
File name:SC 210122 payment Advice.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'518 bytes
First seen:2022-06-07 15:28:55 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:gU2OAQslfy/7UJhQV2F7Otq64XzS5VKv+YPac8HIHhWwtnpiDnnpv/Jd6F/BwGMa:gUOlfQ1Vw79S5Qv+YPaFHIB5npiz9/Jk
TLSH T1C084238831DAF3202E9D5645D23FBC46EC3D907787AA31F0611DCBB6715E3E90A14A9E
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla payment r00


Avatar
cocaman
Malicious email (T1566.001)
From: "altafs@universalstarch.com" (likely spoofed)
Received: "from universalstarch.com (unknown [185.222.58.88]) "
Date: "07 Jun 2022 12:27:41 +0200"
Subject: "RE: PAYMENT ADVISE - SC 210122"
Attachment: "SC 210122 payment Advice.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
340
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3e7d6f76b1b290057134c91556252310fddab14cc08fea5470de10957822e6d/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-06-07 08:39:31 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
21 of 26 (80.77%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpt5n53ldmuqavytjsivkyssgeh53kyuzqep5jkhbxqqsv4cfzwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3e7d6f76b1b290057134c91556252310fddab14cc08fea5470de10957822e6d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 b3e7d6f76b1b290057134c91556252310fddab14cc08fea5470de10957822e6d

(this sample)

AgentTesla

Executable exe 55a43bac7dbdab072611bc31cdb1ff9d2d1006508213dbe700f7d3422e8a542e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55a43bac7dbdab072611bc31cdb1ff9d2d1006508213dbe700f7d3422e8a542e
  
Dropping
AgentTesla

Comments