MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e95856c4482f2158d93bf571e775a24c59b7798583e3f2671318005cd416786. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e95856c4482f2158d93bf571e775a24c59b7798583e3f2671318005cd416786
SHA3-384 hash: f3147c94433a9827f580cf630f10977ca991fef0300b8f63ac86e38a2c9dfce75e51ac23498d8d691bd13b054dcf1254
SHA1 hash: d09ff8ee4beb65a7d61a3c355191433c9d6ae408
MD5 hash: c6c8085256c4d4fe8af3decd95b6a56e
humanhash: beer-triple-solar-oscar
File name:New Purchase RFQ19801.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'798 bytes
First seen:2020-05-13 10:23:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:BFXtdWpxIskMN4qnNAhFhvu7VKD68YNLUh2I7cctnMi6jyKjnns5bUvG992R/Olq:BFesNM+qnNAhjI+6JlUhLztcues5baCk
TLSH 0B8423551FC65AA586334AE4B9BE871CEBB59BA0380C037FFC97409DA747237E252D04
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server852686.nazwa.pl
Sending IP: 77.55.215.240
From: Ahmed Ashraf<corporate@baesystem.tech>
Subject: RFQ FOR STAINLESS STEEL SPRINKLER - VALVES RFQ
Attachment: New Purchase RFQ19801.rar (contains "New Purchase RFQ#19801.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 04:28:05 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j2kyk3ceqlzbldmtx5lr4522etczw54yla7d6jtrggaaltkbm6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4e95856c4482f2158d93bf571e775a24c59b7798583e3f2671318005cd416786

(this sample)

AgentTesla

Executable exe 4be43e080b60c1fe0c24ff6b13a48baa58e0c521a75f6586a80dee1814a04ae7

  
Dropping
MD5 6c5fb414b0fb6feb1ce94638d6d151ac
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4be43e080b60c1fe0c24ff6b13a48baa58e0c521a75f6586a80dee1814a04ae7

Comments