MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e68a8d48032c6c49d22d5d687f8a78819e5e08dca1d86b510472ea7a490f94a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e68a8d48032c6c49d22d5d687f8a78819e5e08dca1d86b510472ea7a490f94a
SHA3-384 hash: 02909e43243b812f7ad0d9b50524e260ebd029e7b0c3d112125af9ddc1a5767a9d588c270459f2f7f23935a5e8ace49e
SHA1 hash: ba0c19574d2b737eb020d00cf70ddb619073cb48
MD5 hash: 5b9f4f70d5805902364582fca4190081
humanhash: nevada-vermont-lake-happy
File name:Purchase__quote.pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:581'958 bytes
First seen:2020-06-03 13:58:41 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:q024Vdh1bbJ+/Hq12Sr5a33ZxeWwnVeXs0gQMF8UzIOOaxvN:X22Jb9+vq84wTNwnVe8FHF8qIOOaZN
TLSH CAC423B391FB29EEBCB85292FAF577D648E414894C946209378D47F4709817ED022FB4
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tepse.gr
Sending IP: 193.29.187.182
From: Rena Balabani - TEPSE SA <rena.balabani@tepse.gr>
Subject: REQUEST
Attachment: Purchase__quote.pdf.r00 (contains "Purchase__quote.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 14:35:48 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzukrveagldmjhjc2xlip6fhram6lyenzioynniqi4xkpjeq7ffa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 3e68a8d48032c6c49d22d5d687f8a78819e5e08dca1d86b510472ea7a490f94a

(this sample)

AgentTesla

Executable exe 898fb94bb9fb9894ad31a2c4eec424aa0de35cfe8fb97f9da0914105d397ea3f

  
Dropping
MD5 82c4743a0fdcf03a6542fcc1042cdff1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 898fb94bb9fb9894ad31a2c4eec424aa0de35cfe8fb97f9da0914105d397ea3f

Comments