MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a68d87ecc2bdf850947621517a08a6507bcdbdccd21921ce8eeac22c11b0e75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a68d87ecc2bdf850947621517a08a6507bcdbdccd21921ce8eeac22c11b0e75
SHA3-384 hash: 72908cb523d1ceea687925634287ca97f026fc98279164c30311cc814465c88fffa2d724d199f9bfde2ca8d2299ef4e5
SHA1 hash: a603d8f6e2dcb39b2386d2405577ba1ac223bc3b
MD5 hash: 7057aa252c09129f82200ba31275c2ca
humanhash: jersey-idaho-thirteen-cold
File name:SHENGDONG Plastics PLC PO-00254.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'338'753 bytes
First seen:2020-08-18 07:40:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:thEfR6uCBBVPALT1JpyW5C61wYi6DFnkQvfYyrmo4AobPpKWTmw5IMDxUupyuVDr:thE56uCBBVWpzyWZ3i6BkcYdbPpKRhK7
TLSH 105533048EB3E71894B30096F296A15D9506A98D70C83F729CBD3FDDBD23B119F87299
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alwaseef.com
Sending IP: 209.58.149.66
From: Kendrick Che-Import Dept <sales@alwaseef.com>
Subject: Re:
Attachment: SHENGDONG Plastics PLC PO-00254.rar (contains "SHENGDONG Plastics PLC PO-00254.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a68d87ecc2bdf850947621517a08a6507bcdbdccd21921ce8eeac22c11b0e75/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 07:42:09 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=djunq7wmfppykckhmikrpiekmud3zw64zuqzehhi52wcfqi3bz2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1a68d87ecc2bdf850947621517a08a6507bcdbdccd21921ce8eeac22c11b0e75

(this sample)

AgentTesla

Executable exe 2f32d708b0b5b6b6bbd476e029d0609c4a5444650a7d4ce53bd476af0b90d4d3

  
Dropping
MD5 7c761c20767536f1bd821394a21a9fb4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f32d708b0b5b6b6bbd476e029d0609c4a5444650a7d4ce53bd476af0b90d4d3

Comments