MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f0a3e33f6a5052574c6535f9775c7997acc512a17f58a7f4938b36f39328533. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f0a3e33f6a5052574c6535f9775c7997acc512a17f58a7f4938b36f39328533
SHA3-384 hash: 29612bc933291e3224e8b715ba1c8a3c3a2bc973576726b6d8de3dd1198181fb72efba69bf8baf1dae434d04e023e1df
SHA1 hash: 7c707c1acbab484041f7c86bf42943e584c56a11
MD5 hash: 6bdf1ff3750842572366e361ad95b966
humanhash: johnny-alanine-ten-bacon
File name:NEW PURCHASE ORDER.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'890 bytes
First seen:2020-07-22 06:15:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:1UNWj+/CiZ0DW4AgbhZk+/12CV2Ytj90vT3zBJU+AqMmCbBmnT7i7ghHfeFC4XOj:1Bj+KiZf4AgVuCZtA7z3CbBmT+yH2bM
TLSH 93A4230EE19D0670337D6E8919B31E0DB2E18DAE0111DB3958597D53DA91EC3A89BE13
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sikorea.co.kr
Sending IP: 103.207.36.135
From: Purchase Assitant< siv_cs@sikorea.co.kr>
Subject: TOP URGENT PURCHASE ORDER
Attachment: NEW PURCHASE ORDER.pdf.rar (contains "NEW PURCHASE ORDER.pdf.exe")

AgentTesla SMTP exfil server:
mail.asianhandicraftsexports.com:587

AgentTesla SMTP exfil email address:
stan@accinning-tw.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f0a3e33f6a5052574c6535f9775c7997acc512a17f58a7f4938b36f39328533/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 06:17:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4fd4m7wuucsk5ggknpzo5ohtf5myujkc72yu72jhczw6ojsquzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f0a3e33f6a5052574c6535f9775c7997acc512a17f58a7f4938b36f39328533

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1f0a3e33f6a5052574c6535f9775c7997acc512a17f58a7f4938b36f39328533

(this sample)

AgentTesla

Executable exe caca9300b1d58c133a495c9c9abebdbca98f81d81608d1acbee4fb3d0a0ebae2

  
Dropping
MD5 094d7ba0d24255e2e718662e1d3ee3c3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 caca9300b1d58c133a495c9c9abebdbca98f81d81608d1acbee4fb3d0a0ebae2

Comments