MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409d12a5b0e51035cbc0150762491840fb8265f3d4ecc82bd8545f336a9c0ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 409d12a5b0e51035cbc0150762491840fb8265f3d4ecc82bd8545f336a9c0ea8
SHA3-384 hash: 19c75c0e8c211156dd9445193c04a2bef57b54787aeb42e1612db7699163f39b905fa4c97d7bee4ecfebb828ae78af93
SHA1 hash: 5fad2e695e545cede8d476c61f50aa6db1c60d6a
MD5 hash: 4e8035bfd49f441a0e32c85a3c96f36e
humanhash: bravo-jig-don-pizza
File name:OIL AND GAS EQUIPMENT SCHEDULE.Pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'371 bytes
First seen:2020-08-10 12:48:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:qoG0CKo7zp0LAfSxNNJ1U4v9eRFSurzFA3JnG8Ks3bl:9roJnfazru/FcG8KsLl
TLSH B4A42381199172ED2BC72E51E0AE5B19F0CED7BB7DAB3C06911230BF4C58319E654B2B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Sridhar Sampath <scampath@jec.qa>
Reply-To: scampath@jec.qa
Subject: RFQ- for supply and delivery of Pump,Valve, Pipe,Steel and Fittings,Machinery
Attachment: OIL AND GAS EQUIPMENT SCHEDULE.Pdf.rar (contains "EQUIPMENT SCHEDULE.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/409d12a5b0e51035cbc0150762491840fb8265f3d4ecc82bd8545f336a9c0ea8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 12:50:08 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icorfjnq4uidls6acudwesiyid5yezpt2twmqk6ykrptg2u4b2ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/409d12a5b0e51035cbc0150762491840fb8265f3d4ecc82bd8545f336a9c0ea8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 409d12a5b0e51035cbc0150762491840fb8265f3d4ecc82bd8545f336a9c0ea8

(this sample)

AgentTesla

Executable exe faad832bfb6f193e546aad045e0d90ff28f4b7c60bf0e711a7f5ff8b90fc5039

  
Dropping
MD5 fc65a5a3bd2125f3139bc62bf1022861
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 faad832bfb6f193e546aad045e0d90ff28f4b7c60bf0e711a7f5ff8b90fc5039

Comments