MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2df86688032ccc827468c61e289ad1bd29551bd26aa7e8f02cb9096a8bf8cfb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2df86688032ccc827468c61e289ad1bd29551bd26aa7e8f02cb9096a8bf8cfb7
SHA3-384 hash: 9b169386f99efd94454a509116acfa91bc80d88fbed1bf9b30ab45af35462a7d36210bd88c4892126047d575d175e66d
SHA1 hash: da5b99c30f736f9422d9de872782bcb47042c604
MD5 hash: 3eddfcae546371d2561c4fd67622143c
humanhash: harry-bravo-hydrogen-yellow
File name:Invoice Copies AC 1702456.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'080'824 bytes
First seen:2020-05-11 08:08:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:hxV4ucI+rk59TYZq1Y9pUIrywkAo2hso7BKFT7lkGD3+uSL6axvcxbCHYNzW6k6n:KuyrgtYZTfnjoCsaBenSYu6aGCAdkbBo
TLSH 0635336F3814381F5894B433645BF23E47E22FDDAF8F8714344C6A6D5F8A4ABA56E008
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.aslankaya.com
Sending IP: 85.95.240.141
From: iprkarnataka@puthrans.com
Subject: A/C# 160286 - Payments request
Attachment: Invoice Copies AC 1702456.rar (contains "Invoice Copies AC# 1702456.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:36 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fx4gncadftgie5diyypcrgwrxuuvkg6snkt6r4bmxeewvc7yz63q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2df86688032ccc827468c61e289ad1bd29551bd26aa7e8f02cb9096a8bf8cfb7

(this sample)

AgentTesla

Executable exe 5ebd8c0f2000d4da534893201e61cf13b6177a2fa7349827c3d463dcf1917e06

  
Dropping
MD5 90ee140ad312f0ac553be65ae479e8d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ebd8c0f2000d4da534893201e61cf13b6177a2fa7349827c3d463dcf1917e06

Comments