MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 305b4eb852109ca39a6c34b949237299f7b8ccb6e73ba00e8399a17ece1fd88f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 305b4eb852109ca39a6c34b949237299f7b8ccb6e73ba00e8399a17ece1fd88f
SHA3-384 hash: 31edd045a756d7c04681e4d5c732db3e83156bab99646f6c9156df0a11e3d37dbcf39aba467b0ed1e62c9cbb7dad0f14
SHA1 hash: 4e897ebf397acc51b1b4c11d1a8120cf9d549792
MD5 hash: 6d2adf8f9c1aeac2c5282fa97f383927
humanhash: timing-wyoming-five-fifteen
File name:Purchase Order.PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'924 bytes
First seen:2020-06-26 07:08:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:qqRaM1kDJziD3WhDtHxfy2oj4WH474/Sz4INRNaPGP4VMeYBF/2kUaaLN8Un:qPAkdziD3c5Zy2I4u/h+0eA7YLCaaLNZ
TLSH 408423B040D7CD52EC0F21027E3AB02E7E6F61B4AABDF71587FA8132612CE596997147
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.51
From: Hamza Elsmadi <hamza@alqariab.de>
Reply-To: Hamza Elsmadi <nicolasdiegonicolas@gmail.com>
Subject: Re:RESEND/Purchase Order
Attachment: Purchase Order.PDF.rar (contains "Purchase Order.PDF.exe")

AgentTesla SMTP exfil server:
smtp.bapipl.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Bredo-AIC.26381.8561.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/305b4eb852109ca39a6c34b949237299f7b8ccb6e73ba00e8399a17ece1fd88f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 07:10:08 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gbnu5ocsccokhgtmgs4usi3sth33rtfw4452adudtgqx5tq73chq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 305b4eb852109ca39a6c34b949237299f7b8ccb6e73ba00e8399a17ece1fd88f

(this sample)

AgentTesla

Executable exe 90e9bd37f7c891f14541e2b3122f29362dba751d98c0da64668ae508f02877f7

  
Dropping
MD5 ce55c1f268c624673b9f04a11511149c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 90e9bd37f7c891f14541e2b3122f29362dba751d98c0da64668ae508f02877f7

Comments