MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06dd18a37cd798f759233763974f35c52aadc3e853d6027312383a4d1cec9861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06dd18a37cd798f759233763974f35c52aadc3e853d6027312383a4d1cec9861
SHA3-384 hash: a3fefeb1fccab9829b372b412fa9155d54793d2365f4ed009757ddeb85771580176eb4584b8cbeadf69deb39ca876e30
SHA1 hash: 8cc197576d069977ab2a80ea75f8d0cd567804a3
MD5 hash: 319e241993624394bbbaeb855a4454b2
humanhash: one-apart-hamper-glucose
File name:INVOICE.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:270'945 bytes
First seen:2020-06-20 06:10:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:pch3b39eL2ImCL3FydgwGFjVQPXXDzZvU/5n8Sko0cWMBYBMIyK:+d9eiImW4dMRQ7zhUh8S/iR
TLSH A9442305649643FCF3F83B0955CE590B96A0657A71A44300B2F4C2B8D8E53EAF69FA78
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp121.ord1c.emailsrvr.com
Sending IP: 108.166.43.121
From: jenni <jenni@uiccpi.co.id>
Reply-To: onyimilala@outlook.com
Subject: Proforma Invoice
Attachment: INVOICE.rar (contains "Proforma_Invoice...exe")

AgentTesla SMTP exfil server:
artapundimekar.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:12:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a3orri3426mpowjdg5rzotzvyuvk3q7ikplae4ysha5e2hhmtbqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 06dd18a37cd798f759233763974f35c52aadc3e853d6027312383a4d1cec9861

(this sample)

AgentTesla

Executable exe 5b93980a4505da90bed78a71e9d746bf2655f7da4c08d8dade7962e1c8766aaf

  
Dropping
MD5 9435b14a5ef4b68228534bc3edbb87e0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b93980a4505da90bed78a71e9d746bf2655f7da4c08d8dade7962e1c8766aaf

Comments