MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6
SHA3-384 hash: f9ad29610e8b79a90db6578c9bafc7048ecd7b456afe274e4dd3147727666de4f6946a947b6f24313816106b640bfbd2
SHA1 hash: 832fc0de2583a6584c64136df504d33ec850e78a
MD5 hash: 66ad80f8660d2ca9716a3cdc8f53d1d5
humanhash: hot-stream-jupiter-maryland
File name:Payment Advice Copy.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'680'392 bytes
First seen:2020-05-11 12:44:31 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 49152:+r1d3Qwhx2drPdhSMbj4dfhktCV82l7J3JKw33XTZ:+33QQx2NXSEj4dfhktmNZJ5H9
TLSH 0E753317351793D64A6EECC1BD3E62F59C0A5C96E80EA30F7429F2DAB24531839F7248
Reporter abuse_ch
Tags:AgentTesla r09


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.javedgroup.xyz
Sending IP: 138.68.249.252
From: Mohammed Shoukat <Mohammed.Shoukat@saudifilter.com>
Subject: Urgent Confirmation for Payment C/I No.: BK200316-1 by Advance\x0a Payment
Attachment: Payment Advice Copy.r09 (contains "Payment Advice Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:37:00 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=colikftgen2xrbxikyrsgbgefupsrlyrwq2jr755jrb7ixne7tda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6

(this sample)

AgentTesla

Executable exe 7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90

  
Dropping
MD5 42133af0845add0288dfa643f83e4097
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90

Comments