MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21539474532ca6e89666c5b0b6e98b406bbca1773a5a29bc188129a43a3a24b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21539474532ca6e89666c5b0b6e98b406bbca1773a5a29bc188129a43a3a24b8
SHA3-384 hash: be4ff2921d29f5710dbdb25553138f71706a561a46443771b3752fd43d02d40859fdb696640b0e375c682d11f82ca827
SHA1 hash: ea0af2af10f8a0b519e4fbdcf48cca304d7e90c2
MD5 hash: 5cdbb9724d9a42f2f2966a417ea4644e
humanhash: oklahoma-bakerloo-white-mexico
File name:BOQ SPECIFICATIONS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:397'612 bytes
First seen:2020-07-21 07:35:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Io8Fc5i6L/f1llUjuhEgibaUqBZawhgmeZu7Z/RWGTm2bnLjo7G2+j2:GQT7lUju6UVhSyZ57rbCoj2
TLSH 578423EAF032ACDC3C12A6EC9D3A529BE505DC27462335C99396D0AC9B8739C1D4D14F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sieckgroup.net
Sending IP: 95.211.208.58
From: Ivan Chan <procurement3@sieckgroup.net >
Reply-To: purchase1@sieckgroup.net
Subject: RFQ_KATARA-TOWERS_METAL-WORKS
Attachment: BOQ SPECIFICATIONS.rar (contains "BOQ & SPECIFICATIONS.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21539474532ca6e89666c5b0b6e98b406bbca1773a5a29bc188129a43a3a24b8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:37:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=efjzi5ctfstorftgywyln2mlibv3zilxhjnctpayqeu2ior2es4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/21539474532ca6e89666c5b0b6e98b406bbca1773a5a29bc188129a43a3a24b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 21539474532ca6e89666c5b0b6e98b406bbca1773a5a29bc188129a43a3a24b8

(this sample)

AgentTesla

Executable exe 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002

  
Dropping
MD5 9f0eea125c8112fba571e60b1d6f5cb4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002

Comments