MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 016a49465a5e8a4d6525e445e64c980e8482fe805f779700708a74eac4fddb95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 016a49465a5e8a4d6525e445e64c980e8482fe805f779700708a74eac4fddb95
SHA3-384 hash: 20750ace0eecdf28f9cd2b6646cebd94d76f9b76a76414998b657f20dc426cad8e2d10065feebe4d13c81e27c9383b91
SHA1 hash: 2717aeac1d0d4f68b20deefed5cc40386324e187
MD5 hash: 2671e80b5b852753cdf09c3e5491cc72
humanhash: oregon-texas-sink-beer
File name:Proforma Invoice_Complete Project_Pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'304 bytes
First seen:2020-06-11 11:16:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:75rCnOHv/lZqHl5+GVqgYWtInFDLRvmeARg3cOOeOrWLC8iwXdp:lCnOPdilYuZnInJLZRAg3vIWLC8iwtp
TLSH 7584231B9D1A83DF5073B993705E7F2B12A1875891FFED0A4F8AB79E12C18D75C58220
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.carryboy.com
Sending IP: 27.254.141.68
From: Mahesh Kini <prasong@carryboy.com>
Subject: Proforma Invoice - Complete Project
Attachment: Proforma Invoice_Complete Project_Pdf.rar (contains "Proforma Invoice_Complete Project_Pdf.exe")

AgentTesla SMTP exfil server:
smtp.moorefundz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 11:18:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=afvesrs2l2fe2zjf4rc6mteyb2cif7ual53zoadqrj2ovrh53okq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 016a49465a5e8a4d6525e445e64c980e8482fe805f779700708a74eac4fddb95

(this sample)

AgentTesla

Executable exe 30fd049e01b512df68d84c6f5a92a705d27ad52327f8e319a760aefec037f792

  
Dropping
MD5 9db7817e5c6ea134829e11801fce6b58
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30fd049e01b512df68d84c6f5a92a705d27ad52327f8e319a760aefec037f792

Comments