MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5f05feff7b4675f5de15b6fce7a7a193ce89239d025ef577810c6451c88cf63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5f05feff7b4675f5de15b6fce7a7a193ce89239d025ef577810c6451c88cf63
SHA3-384 hash: 3e3b3b184d191b9f32e3861edf90a13f7c971513dc02c3e6759e59bcaa981d94b5320d053e9423e42440ede716da0a2f
SHA1 hash: cf5f4aa51f0abcc7bb24f4e3da2c402ebca57fc0
MD5 hash: 8a70fa7f4a481dd3ba61d4f3dc4c3f08
humanhash: thirteen-hotel-delta-stairway
File name:Emailming bank paper payment .r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'984 bytes
First seen:2022-01-15 07:22:48 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:lyZsL1sksAnhj1pXMxCEjyfVO1XLoDIoyg4m2o1XgQuHx9fRelkj0:lrtfdM44KDInmvRgQC+
TLSH T1A094237B32F5352D50764ABBB532BAB3F1E10C5933439230199466483BB928ADFF301A
Reporter cocaman
Tags:AgentTesla INVOICE r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Fast e-Invoice <einvoice@fastsoftware.com.vn>" (likely spoofed)
Received: "from fastsoftware.com.vn (unknown [45.137.22.35]) "
Date: "14 Jan 2022 16:46:33 +0100"
Subject: "=?UTF-8?B?UmU6IENvbmZpcm1hY2nDs24gZGUgdHJhbnNmZXJlbmNpYQ==?="
Attachment: "Emailming bank paper payment .r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed print.exe
Link:
https://www.filescan.io/uploads/61e2765cf2e8ec86fe00a15a/reports/aa7a0bf2-52e7-4731-a09d-de166457254e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5f05feff7b4675f5de15b6fce7a7a193ce89239d025ef577810c6451c88cf63/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-15 07:23:13 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
18 of 43 (41.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xyf737xwrtv6xpblnx446t2de6orerz2as66v3ycddekheiz5rq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e5f05feff7b4675f5de15b6fce7a7a193ce89239d025ef577810c6451c88cf63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e5f05feff7b4675f5de15b6fce7a7a193ce89239d025ef577810c6451c88cf63

(this sample)

AgentTesla

Executable exe aee76e523d9d19b32e7b9e8fdb50e28f851cefcbe87d0b48f68b8f8998a11174

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aee76e523d9d19b32e7b9e8fdb50e28f851cefcbe87d0b48f68b8f8998a11174

Comments