MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fda5f6d876e170d1f8181644a0ca66743f178b0ab3c6aabe49b13a642201848b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fda5f6d876e170d1f8181644a0ca66743f178b0ab3c6aabe49b13a642201848b
SHA3-384 hash: 9526453ca93e6cdacb18b11d361a8020453e71f12041f0a79aa166eb8c6dddb84502d355e037f7a696bd8c288d813702
SHA1 hash: f0d962b0a08593ef930a1c1f2287748bb6e2517c
MD5 hash: 590fff6ba64027a7e6544dc38e2b0509
humanhash: equal-skylark-six-mike
File name:New_OUTSTANDING _INVOICS.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:660'269 bytes
First seen:2022-08-05 08:57:55 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:YsRU9crqwUomYx3KNCLATRZl+erDBgl91pZ77lfJJNDnFUICBYQF/xZ:Ysic9EALMUeHBgJ77lfJJDC6g/b
TLSH T17FE4235D438A49ABDF6F454B2F7969167AC9C07B250786E20C13AB73FDB0829500B8F9
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AgentTesla r01


Avatar
cocaman
Malicious email (T1566.001)
From: "diah.sari@behnmeyer.co.id" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.67]) "
Date: "5 Aug 2022 10:57:30 +0200"
Subject: "RE:OUTSTANDING INVOICS"
Attachment: "New_OUTSTANDING _INVOICS.r01"

Intelligence

File Origin
# of uploads :
1
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fda5f6d876e170d1f8181644a0ca66743f178b0ab3c6aabe49b13a642201848b/
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-08-05 08:58:16 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ws7nwdw4fynd6ayczckbstgoq7rpcykwpdkvpsjwe5giiqbqsfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fda5f6d876e170d1f8181644a0ca66743f178b0ab3c6aabe49b13a642201848b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 fda5f6d876e170d1f8181644a0ca66743f178b0ab3c6aabe49b13a642201848b

(this sample)

AgentTesla

Executable exe 97dd77ad0f9451b6a1becd5890ff9222044562e499198df48122718dc1d09975

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 97dd77ad0f9451b6a1becd5890ff9222044562e499198df48122718dc1d09975
  
Dropping
MD5 4ccda623ab362d42c44fda2f3865300e

Comments