MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c1251d1779735a418b580c6ad006339b3fca4516e2797328779ddd91dd0cf18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c1251d1779735a418b580c6ad006339b3fca4516e2797328779ddd91dd0cf18
SHA3-384 hash: 2b39cba107f21c269c02184ede7538f2eb85c92ce53e0a42cbf806ca66cb2478a9ff11e45f27a7052dcd21bde945b0d7
SHA1 hash: ce4fc34455121d85b152c0ff098fc6a2989e1e6d
MD5 hash: 154529e043941b3525074999934269a8
humanhash: zulu-burger-green-timing
File name:NEW_ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'270 bytes
First seen:2020-06-16 13:51:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ehDZFnc9qhgXohmlxK1ZE/xUYuLk9e+MfB:6DZFnc9qhKgmcw12xB
TLSH 9E842393012F655F82D4367A9862EBCA7918FDD752B81806C86309CED7D3DC14C1B6EB
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkhalidgroup.com
Sending IP: 103.99.1.173
From: RAMESH KUMAR GUPTA<sales@alkhalidgroup.com>
Subject: RE: INQUIRY CONTRACT ORDER
Attachment: NEW_ORDER.rar (contains "#NEW_ORDER.exe")

AgentTesla SMTP exfil server:
mail.pro-powersourcing.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 13:53:05 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqjfdulxs422igfvqddk2addhgz7zjcrnytzomuhpho5shoqz4ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1c1251d1779735a418b580c6ad006339b3fca4516e2797328779ddd91dd0cf18

(this sample)

AgentTesla

Executable exe 64c03c4f1e488b05a2284a05abae677689881f3c02f365f0c078b94ff22eb6e0

  
Dropping
MD5 3a0eb6e331ca4e4e01c1b97cea20529b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 64c03c4f1e488b05a2284a05abae677689881f3c02f365f0c078b94ff22eb6e0

Comments