MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e56d86578672b9651a65689ff15475124c21bd3ad21e1d733d0793de69a719bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e56d86578672b9651a65689ff15475124c21bd3ad21e1d733d0793de69a719bc
SHA3-384 hash: e2e524c97881d10bd9688fa6de7007b51b768a399aa4f4270acf60e6118967fdd7e771b5639033ac9a91fbc0b8e3e785
SHA1 hash: 7570a7d6587b6e6009fcaee62f82af1ac185a1ea
MD5 hash: 171e3495ebc489eada06932815859078
humanhash: kilo-florida-fix-burger
File name:11X44.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:336'119 bytes
First seen:2020-10-12 05:50:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:04Dw3PIjr/02EknzsbtxBOmBnqvOQK54Wz+Vx5CuNfpZRSAyrinNa6+uvKm72zF:/DmWr/0ROkb0sS7YufSbWk6tZq
TLSH 4964232F3A7C652CBD76513E38354F1798F8C67DE05213D755E02DBB0CAA239243AA4A
Reporter abuse_ch
Tags:r11


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.esteem.com.my
Sending IP: 124.217.245.66
From: Nina Rall <nr@pbi.co.at>
Subject: RFQ. : 11X44
Attachment: 11X44.r11 (contains "11X44.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e56d86578672b9651a65689ff15475124c21bd3ad21e1d733d0793de69a719bc/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:43:33 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4vwymv4gok4wkgtfncp7cvdvcjgcdpj22ipb24z5a6j542nhdg6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e56d86578672b9651a65689ff15475124c21bd3ad21e1d733d0793de69a719bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e56d86578672b9651a65689ff15475124c21bd3ad21e1d733d0793de69a719bc

(this sample)

AgentTesla

Executable exe 9f472d0e4e519e465b9f5a5868354d7f8107f10680186ac301f2b700e762ea95

  
Dropping
MD5 32026b8e61e2fe6e971837947d2b7d25
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f472d0e4e519e465b9f5a5868354d7f8107f10680186ac301f2b700e762ea95

Comments