MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 560524acba826c997586ab2d9f5c164dccb710ff7714759300862c79450d68ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 560524acba826c997586ab2d9f5c164dccb710ff7714759300862c79450d68ba
SHA3-384 hash: 1fb419e9ccc0ff76bc7cbbca05e77b048e91a1afb1c47fb75f59d511d0948337ad320e84dd61484c82741d8fd5c5ee12
SHA1 hash: b9322a0ce0c7befb71ba1f83736d9757b4853d16
MD5 hash: 303e5e65ebf2e40c8a1ae493231847c1
humanhash: black-victor-bakerloo-floor
File name:Official purchase order PO.40295380.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:509'197 bytes
First seen:2020-07-29 12:46:27 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:Lb32OkYAVVqK8MMs4dws613srHzUQZOXN405a:0YyqKPnoHzUQeN405a
TLSH CEB4239CF5B5D4AA83FA85C9A5F6D029F2840CA5DDDF101311FC5EC10AA8F42F879E1A
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv.idxdnszone107.com
Sending IP: 54.36.51.187
From: Lívia Géczyová <sales@kimex-bg.com>
Subject: RE:Official purchase order (PO.4029530)
Attachment: Official purchase order PO.40295380.arj (contains "Official purchase order (PO.40295380).exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/560524acba826c997586ab2d9f5c164dccb710ff7714759300862c79450d68ba/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 12:48:08 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kycsjlf2qjwjs5mgvmwz6xawjxgloeh7o4khleyaqywhsrinnc5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/560524acba826c997586ab2d9f5c164dccb710ff7714759300862c79450d68ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 560524acba826c997586ab2d9f5c164dccb710ff7714759300862c79450d68ba

(this sample)

AgentTesla

Executable exe a5a2748fa5b4e8ec996c3a400fa9250c3172ce43e3c8dbae8d26f825566d8d07

  
Dropping
MD5 469e36cf8c1be6db91faa569b67b7d80
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5a2748fa5b4e8ec996c3a400fa9250c3172ce43e3c8dbae8d26f825566d8d07

Comments