MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 399662f1dfc771e85c62c3f5ef0233292578ed2c9ffcabe9c77bacaa4e422c44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 399662f1dfc771e85c62c3f5ef0233292578ed2c9ffcabe9c77bacaa4e422c44
SHA3-384 hash: 6ca942c9a57d18115db4ec2fb8681dab93a0ebcd6c7c4fe740e92c3223e99acdc1fa5bf8489778d46b4cf38795006430
SHA1 hash: 56f1f5cbeba9bf65a09ab7b10557f30a7c0b91ad
MD5 hash: ac9bb26c582319b9d401b515f590015e
humanhash: rugby-zulu-rugby-thirteen
File name:P.O ORDER 4567234.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'675 bytes
First seen:2020-06-03 09:08:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:8368/teCq9jwsq11T4nyzTZGXwZP6FmDXP+O1pPUi/ZcN/dLdP68kWeXTW0ogSuB:83gVNq/T4NGomDrUw69U9X3mIx9oQ
TLSH 109423C4134750AFBE16C69951C2F79E3B4ADEB0671FF6A0CF9910E96F61A2890BC085
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps1942293.fspirits.com
Sending IP: 80.82.215.10
From: Ali Torabi <ali.torabi@rad-co.net>
Subject: P.O ORDER #4567234
Attachment: P.O ORDER 4567234.rar (contains "P.O ORDER #4567234.exe")

AgentTesla SMTP exfil server:
mail.sridurgaagros.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 00:25:00 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hglgf4o7y5y6qxdcyp266artfesxr3jmt76kx2ohpowkutscfrca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 399662f1dfc771e85c62c3f5ef0233292578ed2c9ffcabe9c77bacaa4e422c44

(this sample)

AgentTesla

Executable exe b36bbb0eb9a01f864b737da49dc227f0db18ac8ae3fcac18d829b2c773d62f8b

  
Dropping
MD5 ccfc3c5757ee0f879d50bc10a54593af
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b36bbb0eb9a01f864b737da49dc227f0db18ac8ae3fcac18d829b2c773d62f8b

Comments