MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 218039feff62488500b1e17239a11b1b932de7b3a720bb597ba8ec3fdb33f97b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 218039feff62488500b1e17239a11b1b932de7b3a720bb597ba8ec3fdb33f97b
SHA3-384 hash: 121c6bc3436edd89be75afaf9f1e899f8a46cb3b3d06932310c75a7bedd0529ea66fdfee3a0af0321561a4aea6e2fd90
SHA1 hash: 2d1110580c1b1103c9fdc7862b630eb4bcb0771e
MD5 hash: 58e7615b07069f6ad201b36ed28403d0
humanhash: early-robert-mobile-jig
File name:Receipt for Order 1144.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:379'461 bytes
First seen:2020-05-25 13:57:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:BoODVBJ9oV5kgtIj7YZMW8BPL1ztKN0HM/0cTPVOEsICt3SwNc2X6mlXPe8dA1In:bvJWV5tIj0uFtS0HM/0kdV7nwNLnXWGn
TLSH 748423EB93B5CA1D7DDFC9403FAA9E805FA85F7B0A145544175A0B322F8D2A4CC2D43A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: seedmech.com
Sending IP: 209.58.149.65
From: Mainkar<vijaymainkar@seedmech.com>
Subject: Re:Fw: Purchase Receipt for Order #1144
Attachment: Receipt for Order 1144.rar (contains "Receipt for Order #1144.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:30:29 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 218039feff62488500b1e17239a11b1b932de7b3a720bb597ba8ec3fdb33f97b

(this sample)

AgentTesla

Executable exe e6f512cfa75e700baf5ca97be34d3b8dc03f4459dd2c11b018ad18d68140a988

  
Dropping
MD5 354ed8884c3a40a6b7c617af1bdadcc7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6f512cfa75e700baf5ca97be34d3b8dc03f4459dd2c11b018ad18d68140a988

Comments