MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d2254e0b55892097e48816d4026a94a1a07230bd77c0b4f74186917f182d3c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d2254e0b55892097e48816d4026a94a1a07230bd77c0b4f74186917f182d3c3
SHA3-384 hash: 4ce54c51b4482625e55c3641671fabb959d93cfdcf754f49e0cd61f64221c6ea1478af15a989ba37a3f99c8db0f062a3
SHA1 hash: 38b60b42d7ed2e8bc74e25013fce0a120fbb0b9f
MD5 hash: dc7e6c00849aeecda84d5187d2d43b0b
humanhash: yellow-hotel-ten-kilo
File name:PO19106UFIL11741 0014928.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:468'063 bytes
First seen:2020-06-02 10:54:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:c1p/r0poH61zpixjTVDP8MwtUDRK/zN1mb7xr3Peck:WpD0pGbT9nwWD8/5s7xLeck
TLSH FCA423FA1E44FB439A23819DCE5D0273FE77ADF21336A87DD4081110AEA35C6E926724
Reporter abuse_ch
Tags:AgentTesla HostGator rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway21.websitewelcome.com
Sending IP: 192.185.45.140
From: kafafy@alutechs.com
Subject: Quotations - RFQ-PO#19106UFIL1174
Attachment: PO19106UFIL11741 0014928.rar (contains "PO#19106UFIL11741 (#0014928).bat")

AgentTesla SMTP exfil server:
mail.officelog.org:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 02:55:00 UTC
AV detection:
10 of 31 (32.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=durfjyfvlcjas7siqfwuajvjjinaoiyl256awt3udburp4mc2pbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1d2254e0b55892097e48816d4026a94a1a07230bd77c0b4f74186917f182d3c3

(this sample)

AgentTesla

Executable exe b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56

  
Dropping
MD5 983aad68a81d7136e4f55c39bdd8230e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56

Comments