MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bc88acb1adaeb42077029310d6a098063dd03fa8d222212da98d5187a3be540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bc88acb1adaeb42077029310d6a098063dd03fa8d222212da98d5187a3be540
SHA3-384 hash: aa3e22ffd1b5d6ea666b8cc1e473e0cf1a84025060cc680858218c3065b23cd447a9a462dca8bd19f258b206c422e323
SHA1 hash: 4c3eead277aa1e113968fcccf994ad21a09d4561
MD5 hash: 6c3059f91f318cfd9512df9ff62b56a7
humanhash: snake-maine-table-johnny
File name:New ORDER01624PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:421'572 bytes
First seen:2020-06-08 06:47:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:+2tjCbOVc26NTzrRo0qVQ+1H4iuQSncDxrYQPIvvbs09THE+zZ881mIu88vfqSXT:+WjcfTCxQ+x4iuQSnpvTHEzzh76SXT
TLSH 869423302F9C6A2861D7D4ACFFE94F14166455EB2A522DBCAFE1D404AC236D09C4BB4B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.eben-ezer.es
Sending IP: 146.255.101.138
From: Tapani Koskimies <Logistics Coordinator> <tapani.koskimies@egavrielides.fi>
Reply-To: Logistics Coordinator <worldnetofficemailer@gmail.com>
Subject: New Order Confirmation_01624PDF
Attachment: New ORDER01624PDF.rar (contains "7UNqtxzqan3sp7Z.exe")

AgentTesla SMTP exfil server:
smtp.outlook.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 01:33:37 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpeivsy23lvueb3qfeyq22qjqbr52a72rurceew2tdkrq6r34vaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2bc88acb1adaeb42077029310d6a098063dd03fa8d222212da98d5187a3be540

(this sample)

AgentTesla

Executable exe b60cffb90b7d115ebeb73bb66ceb3d64e33357d2b68ca0ff1d77ccfa14f2cf49

  
Dropping
MD5 85bc2c6782588995ba58b97707c5bcf1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b60cffb90b7d115ebeb73bb66ceb3d64e33357d2b68ca0ff1d77ccfa14f2cf49

Comments