MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02a3fe2cb435f12ac2662c2767b06faed1802f9fba0d593da806f6696b99e080. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02a3fe2cb435f12ac2662c2767b06faed1802f9fba0d593da806f6696b99e080
SHA3-384 hash: 41e0ca61135e35ba124cd9b5ffe24678052b5623b63cbb12e6e8abdf22e6eb0f7ce7ec1bae1827e09935504d4b17a64d
SHA1 hash: f758a8baecf4a1cf3c3d7db6c057bb524d2f6aad
MD5 hash: 763697d550b9356058c73279dfc1fe66
humanhash: cold-river-delta-oklahoma
File name:Inquiry Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'477 bytes
First seen:2020-06-02 07:27:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:B7LeeqEcLeAxpxRS+r2IySUJtq8UV/I8PfaZYi:B7LvqlNxRS+SxSa8KZt
TLSH 27A42302C0399F27876A35B8EE74A5AACC7FBCD9045578DA743690D50C87E4AE06CB73
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp5.intred.it
Sending IP: 62.97.32.61
From: Gina (Gina) Breedt <eugenio.braghini@intred.net>
Reply-To: sanpoyan@staff.hkbu.edu.hk
Subject: New Inquiry Order
Attachment: Inquiry Order.rar (contains "Inquiry Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 07:36:37 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=akr74lfugxysvqtgfqtwpmdpv3iyal47xigvspnia33gs24z4caa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 02a3fe2cb435f12ac2662c2767b06faed1802f9fba0d593da806f6696b99e080

(this sample)

AgentTesla

Executable exe 5afb8b1e08dee442332deaabd3fb126ffd9d4b34056aa33e121f24776086695a

  
Dropping
MD5 fa4f1460275e418e806f1aa28697c2ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5afb8b1e08dee442332deaabd3fb126ffd9d4b34056aa33e121f24776086695a

Comments