MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29ff7d2d68a2ccce30af03ad5dda11da3180ed2625076751f2c4ef5292d5a554. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29ff7d2d68a2ccce30af03ad5dda11da3180ed2625076751f2c4ef5292d5a554
SHA3-384 hash: 8150d55064561612ff344480f2c5e3e8d1298bd649d22a8d9d2dcd5c8bfb13db7f9f48fa899bca5340146c497c47d6fe
SHA1 hash: 3d4cfa5a1f688515c2949e32b58d2856a3664348
MD5 hash: 5f74d715362f8a4d7a5645a8da513b8f
humanhash: foxtrot-louisiana-jupiter-eleven
File name:SKCM_20200429_6386357255253523763263.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'238'162 bytes
First seen:2020-04-29 16:40:33 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:ma/nS4TQuFfTGhlHlFqmvgAnJU623hAHq2Y2skaCJdsmrobrbfv+jmOc:l/nS4TQuFfTQHlcmRW73OK24kZrSv+js
TLSH 2B4533CF72E8368775ACCD0F9F0861C6662B2CC89F44160264EA7E5E6F52C168C75AF1
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: beian-lock.com
Sending IP: 156.96.58.98
From: sales@beian-lock.com
Reply-To: 'sales@beian-lock.com' <allyson4george@yahoo.com>
Subject:
Attachment: SKCM_20200429_6386357255253523763263.r00 (contains "SKCM_20200429_6386357255253523763263.exe")

AgentTesla SMTP exfil server:
mail.karumas.com:587 (199.79.62.18)

AgentTesla SMTP exfil email address:
bulentoktay@karumas.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 17:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fh7x2lliulgm4mfpaowv3wqr3iyyb3jgeudwoupsytxvfewvuvka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 29ff7d2d68a2ccce30af03ad5dda11da3180ed2625076751f2c4ef5292d5a554

(this sample)

AgentTesla

Executable exe 904d077a8445b8b25a33703b1a5d4e78a01f79a31e705d2634bb300aca54d2ac

  
Dropping
MD5 f84f274d2ccf8b6ee6b043da27d13436
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 904d077a8445b8b25a33703b1a5d4e78a01f79a31e705d2634bb300aca54d2ac

Comments