MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1baddc6589319bbb6a56a53a23e66d86e7fb621b8e7ed8df0e411d501e97e958. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1baddc6589319bbb6a56a53a23e66d86e7fb621b8e7ed8df0e411d501e97e958
SHA3-384 hash: e2121829ece74f36ed38e177c8eaaae88f756c92e955ef08cbc178fb5dbfeb81fc93bc8e14e8dce9b42e6df3e2120c1d
SHA1 hash: 0e71f84d735093eee83a73c197edd8b255d39118
MD5 hash: 1772e4b5f46860321d069491de9c1724
humanhash: nebraska-mississippi-montana-edward
File name:IMAGES AND SPECIFICATIONS - RFQ DTD24-0720PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:369'661 bytes
First seen:2020-07-29 14:41:30 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:uKd6MCwnjCcUyyJrEl/V0JHYIrrvqTnnX3Oww8gt9YN+ql8VVpje7m5l9AS+ThXX:ZlnOxjeLnX/KYcu8VVk7mdAS+1XSkXn
TLSH C074239129AF2D330AB825277761E7C2A26CA055300FB5165CCDA3FB1E917F31225DB2
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 3goz.com
Sending IP: 213.128.71.98
From: Aisha Amari <6667hs@naver.com>
Subject: Product Inquiry - RFQ DTD290720
Attachment: IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.z (contains "IMAGES AND SPECIFICATIONS - RFQ DTD 24-0720PDF.exe")

Unknown payload URL:
http://wellcraftint.com/file.exe

AgentTesla SMTP exfil server:
mail.anantcreation.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1baddc6589319bbb6a56a53a23e66d86e7fb621b8e7ed8df0e411d501e97e958/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dow5yzmjggn3w2swuu5chztnq3t7wyq3rz7nrxyoieovahux5fma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1baddc6589319bbb6a56a53a23e66d86e7fb621b8e7ed8df0e411d501e97e958

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 1baddc6589319bbb6a56a53a23e66d86e7fb621b8e7ed8df0e411d501e97e958

(this sample)

AgentTesla

Executable exe 8137453fed9c0a1397eca9dd59e64141fffbd6cabf760d420adf44d4a049e40a

  
URLhaus
https://urlhaus.abuse.ch/url/421468/
  
Dropping
MD5 3dcfc5cfe8b39da98c591b6e977811a2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8137453fed9c0a1397eca9dd59e64141fffbd6cabf760d420adf44d4a049e40a

Comments