MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f857410dcc5357b3d5239ff8e922ab5abd23ae24edd0848c4c6d823de86607e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f857410dcc5357b3d5239ff8e922ab5abd23ae24edd0848c4c6d823de86607e
SHA3-384 hash: 5f152dc21a756a37ce0e1ebb42f41b80ff607e74ee78f0dd897875fb3b2e47dfe2f4c8c205f33e0569cbd068852b5b54
SHA1 hash: 29e578329f06fdbe4373ee2d2d71a17337644734
MD5 hash: 80bc075bc90d6e5d7109ffee00645e2e
humanhash: river-colorado-king-salami
File name:GHM-89766.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:568'576 bytes
First seen:2020-06-04 06:18:59 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:tKpjnSHcenCkkTKu9jsNxTaD1jno13crCYTcMa+vEEbeBpY5LP4:tSjwceeTKgsTaD1jno13sXAMa+vEEbev
TLSH C6C4236BE8CFB8DA4211438B94257B8F9FAF5487FBD25F5901A58338C80D7953940ECA
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.pentagonromania.ro
Sending IP: 94.177.99.247
From: Alessandro Varlese<sales3@hbkailang.com>
Reply-To: sales3@hbkailang.com
Subject: PRODUCT CLARIFICATION
Attachment: GHM-89766.arj (contains "GHM-89766.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 06:37:23 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b6cxieg4yu2xwpkshh7y5erkwwv5eoxcj3oqqsgey3mchxugmb7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 0f857410dcc5357b3d5239ff8e922ab5abd23ae24edd0848c4c6d823de86607e

(this sample)

AgentTesla

Executable exe a385cf35d627fa6e686aa5b19d2196180460707500e430330c0dce28d7815481

  
Dropping
MD5 fc8cef0860174ef6110cf5e9cfc8761a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a385cf35d627fa6e686aa5b19d2196180460707500e430330c0dce28d7815481

Comments