MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26542539743f8441f258d2245ec70ee6aeab9649adedc1ac1c3657feb36f3dec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26542539743f8441f258d2245ec70ee6aeab9649adedc1ac1c3657feb36f3dec
SHA3-384 hash: b7d25a162e8599aecaceb86a1298980dddc53f77da562eeb3cbdc5aad0e8d1548f176bb11febcd5f2c61d6349581987f
SHA1 hash: ef68e80fd8ae83b8a80782bf750982ab1d2b2d65
MD5 hash: 66918f807af21fb89462ef9c7d5b6736
humanhash: timing-crazy-winter-missouri
File name:Purchase Order Glencore International AG.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:767'321 bytes
First seen:2020-07-16 06:26:54 UTC
Last seen:2020-07-16 07:03:09 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:+Fg17qZlcDtWf2hYCVaWf88Zico3KqCjH5Ye/wwifzHeFPGVamrygSWq0/VfdMj5:d17qZlcDttjaiCcoKq+HHwHebuygSV04
TLSH EFF4339F1FA57C23624B4CFA4CD91947C8A4AC0A4258D3D9EBA9009DED7C539C7AF318
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se1e-lax1.servconfig.com
Sending IP: 173.231.224.5
From: Gabriel Steiner <gabriel.steiner@glencore.com>
Reply-To: Gabriel Steiner <gabriel.steiner@glencore.com>
Subject: [Glencore International AG] Request quotation for supply & manufacturing, Purchase Order no: GL34853487
Attachment: Purchase Order Glencore International AG.rar (contains "Purchase Order Glencore International AG.exe")

AgentTesla SMTP exfil server:
smtp.flowtech-eng.net:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26542539743f8441f258d2245ec70ee6aeab9649adedc1ac1c3657feb36f3dec/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 06:28:10 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ezkckoluh6ced4sy2isf5ryo42xkxfsjvxw4dla4gzl75m3phxwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 26542539743f8441f258d2245ec70ee6aeab9649adedc1ac1c3657feb36f3dec

(this sample)

AgentTesla

Executable exe 4dd12f1cfe04bb5e3c80fae56fb501200e3237c7e2059acba45257f67ca7eecb

  
Dropping
MD5 3b9de61c232af89395b08a4d95ef37f5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4dd12f1cfe04bb5e3c80fae56fb501200e3237c7e2059acba45257f67ca7eecb
  
Dropping
SHA256 22d92e9b0441722e2eec1d718cfbc78036132d57b15ec9ab1a84170cd1633efe
  
Dropping
MD5 87602c587f1e8a6edfefd4104a779744

Comments