MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 482508de6517a1e9a74ae3bccb1c83ea87550cc65cf40cd4897f8d0baf654bce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 482508de6517a1e9a74ae3bccb1c83ea87550cc65cf40cd4897f8d0baf654bce
SHA3-384 hash: 8315f686ae13ae19bc9a1fbeed3c587f9eb8a4e2fe36bc8b07167b13dd2c10ff40599fc1039c235afaec14291297f79f
SHA1 hash: ca4d6ea4d27264ce1235f348814fdf26bf33c739
MD5 hash: a561a9161e25ec162d66a86547951447
humanhash: maine-aspen-item-enemy
File name:PRODUCT SPECIFICATION.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:464'008 bytes
First seen:2020-05-07 07:05:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:YkidtMNAwO4EkgHy4OG1132DTN/S01sPQxz:didteWpkgS9bDR/RsIJ
TLSH A8A4236FCA37668A74F5CD641C32A0E4F11EC2A06D0D840DD576F1CFADBA808F85B996
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway34.websitewelcome.com
Sending IP: 192.185.148.119
From: grp@buildtecfibreglass.com
Subject: PURCHASE ORDER
Attachment: PRODUCT SPECIFICATION.rar (contains "H8pkkXDMNSesvys.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 07:36:40 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jasqrxtfc6q6tj2k4o6mwhed5kdvkdgglt2azvejp6gqxl3fjpha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 482508de6517a1e9a74ae3bccb1c83ea87550cc65cf40cd4897f8d0baf654bce

(this sample)

AgentTesla

Executable exe e909cbf5a12f8309b93746f877cb4cdf0b8a41d07c4b2badbf917748679213d2

  
Dropping
MD5 876593a2d1bede193fcc3ef81b5eef4e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e909cbf5a12f8309b93746f877cb4cdf0b8a41d07c4b2badbf917748679213d2

Comments