MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 111fbfe545923deaa9231d110acd4d123ed84df3f13c803cfe064d8efdf34e96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 111fbfe545923deaa9231d110acd4d123ed84df3f13c803cfe064d8efdf34e96
SHA3-384 hash: d3bbbe14507f797abf5bcf754cec9ea143081257269b22f846aae267438cab064c0e66aa38ddeb06adb4085b7381e052
SHA1 hash: bb4c8fbf5e9151c08c8cf9c3ee7dedd7ae032858
MD5 hash: 0a389707c85287bbeb3560a16dcef916
humanhash: glucose-california-cold-victor
File name:DRAWINGS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:344'120 bytes
First seen:2020-07-13 06:23:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:aDPowocy33m+UBm4cxPhO2q0HmJEQBj/H91WW6Tn3J35TIrp3eZwHUloTA8j:aDAwoccm+cKh8nJEQPBC3lIl3RUloTlj
TLSH F874232F53736DAE4F3E105BEC115CA26BD5C60093994E8F2B816DCAA9C7C1233D646E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cp01.knexel.com
Sending IP: 213.136.82.245
From: LIWA PURCHASE <office@as-ltd.az>
Subject: LW/20/12192 - RFQ # 97572681
Attachment: DRAWINGS.rar (contains "DRAWINGS.exe")

AgentTesla SMTP exfil server:
smtp.blueskypaclficgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/111fbfe545923deaa9231d110acd4d123ed84df3f13c803cfe064d8efdf34e96/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 06:25:05 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cep37zkfsi66vkjdduiqvtknci7nqtpt6e6iaph6azgy57ptj2la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 111fbfe545923deaa9231d110acd4d123ed84df3f13c803cfe064d8efdf34e96

(this sample)

AgentTesla

Executable exe 34cf69d94adcbf7c3646400b9d457de10e974790ffa71278291b61426005f13e

  
Dropping
MD5 ca8c87affb36ce80079f499ca8dd3182
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34cf69d94adcbf7c3646400b9d457de10e974790ffa71278291b61426005f13e

Comments