MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03c21c38323a217163bccba3b1923f38c5075da8d25ff42498641efe4e53d426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03c21c38323a217163bccba3b1923f38c5075da8d25ff42498641efe4e53d426
SHA3-384 hash: 4ae180c912794ed1b617ec2ab1a088bd47d52d5e774a6b96074293e9b07ce596b8e7fec60ed1fb29951dc89660657cc9
SHA1 hash: 3902b4141f6df90f39b40c27d9551a430407fad4
MD5 hash: 5308e9a51eb17465f0d829539a17088c
humanhash: rugby-moon-jig-whiskey
File name:SKM WB 12082020082613.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:507'565 bytes
First seen:2020-08-14 10:11:32 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:v/ZgvcSw/FjI0aBvqRki1l+bMp+jBhzbjcagkyb1QXQ:nIyFjTa1TUobJjzPgr+Q
TLSH CDB4233E4EC81AB3F4B2F34EB94941B01762B19E256F820354F8EFB7D54B12E5A91821
Reporter abuse_ch
Tags:AgentTesla r00 UPS


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-107411.us-midwest-1.nxcli.net
Sending IP: 209.126.25.153
From: UPS Quantum View <ktslogisticsltd@ups.com>
Subject: UPS Ship Notification, Tracking Number 6EMJ88666586442332
Attachment: SKM WB 12082020082613.r00 (contains "SKM WB 12082020082613.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03c21c38323a217163bccba3b1923f38c5075da8d25ff42498641efe4e53d426/
Threat name:
ByteCode-MSIL.Trojan.LokiSteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:13:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=apbbyobshiqxcy54zor3der7hdcqoxni2jp7ijeymqpp4tst2qta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/03c21c38323a217163bccba3b1923f38c5075da8d25ff42498641efe4e53d426

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 03c21c38323a217163bccba3b1923f38c5075da8d25ff42498641efe4e53d426

(this sample)

AgentTesla

Executable exe 209d60098db11bc58bb718087d3eda9440a1d443a373c87010f2a1fe3f7cba8a

  
Dropping
MD5 fcfd49c5d9845006aa0b89be1a89afe7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 209d60098db11bc58bb718087d3eda9440a1d443a373c87010f2a1fe3f7cba8a

Comments