MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2302166012f8814a00b8bd804bd50d0ab9004d04309b47bc7f545231c9e999d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2302166012f8814a00b8bd804bd50d0ab9004d04309b47bc7f545231c9e999d0
SHA3-384 hash: 716cfa04f25a3a110a2509d753a9a0d9d0e30c605888e6cdb40471a6070201433e6b03618d2501d55dfc36e59b9ef565
SHA1 hash: 935efeb2416a023e336da43471972e8a7c148a6a
MD5 hash: 98782f4a06471cd3fcb95da5a6d048a8
humanhash: lamp-burger-nuts-carolina
File name:May requested order pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'164 bytes
First seen:2020-06-15 12:40:30 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:aDMVIF8waiYLnHV52Y/xyTzMYGUzftxJlUGLoWLuc5UJ/vEm35j:aYVIFra1LHVE4xoGUzftjlUoupXrd
TLSH 4C84233AD54573C5382D583ECFEE280E188400F4B3B99AB4C215AFDF746AEA69507D68
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: surfachem.com
Sending IP: 37.48.85.240
From: LINDA<info@surfachem.com>
Subject: May requested order
Attachment: May requested order pdf.arj (contains "May requested order pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 09:31:46 UTC
AV detection:
24 of 47 (51.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=embbmyas7cauuafyxwaexvinbk4qatiegcnuppd7krjddspjthia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 2302166012f8814a00b8bd804bd50d0ab9004d04309b47bc7f545231c9e999d0

(this sample)

AgentTesla

Executable exe 4febc2dad98abd9fd2428e9902020e1ffb959e672639d593db38512535ae49d2

  
Dropping
MD5 dda423242a2ff3c9bdc7dbfca2737ebc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4febc2dad98abd9fd2428e9902020e1ffb959e672639d593db38512535ae49d2

Comments