MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e0cb1749e894700aa9eb2fbf96414293a616ddc28890fe463c3389a0396f0b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e0cb1749e894700aa9eb2fbf96414293a616ddc28890fe463c3389a0396f0b8
SHA3-384 hash: 0789144b71eb914b136a651b9442865fb5b78b31c7283c85821e480acb249cdf821ba5cb1ca3c080b59249bf2701f3d4
SHA1 hash: 564456d34ecfeb7a7a0ecef4f04e5c7289c1508b
MD5 hash: 9d91cc33a9468a9e9d4f7a5d06f0b90b
humanhash: sink-texas-nuts-three
File name:PO.4029530.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:927'911 bytes
First seen:2020-06-10 10:00:13 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 24576:6i3STO7o8cKlsOhSwE6oh03RkjvrfxouRpV1026g+US:/SSs8cm1M03RkjTxoIerg2
TLSH 131533EB852009B33EB20E714B20736BD2DDDA1D5B571A26ED58CAF70AEC1537487D82
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpanel2.centrin.net.id
Sending IP: 202.146.241.44
From: Janssen Pharmaceutical <info@janbe.jnj.com>
Subject: Official purchase order (PO.4029530)
Attachment: PO.4029530.r01 (contains "PO.4029530.exe")

AgentTesla SMTP exfil server:
mail.radianthospitals.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 10:02:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyglc5e6rfdqbku6wl57szaufe5gc3o4fceq7zddym4jua4w6c4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 5e0cb1749e894700aa9eb2fbf96414293a616ddc28890fe463c3389a0396f0b8

(this sample)

AgentTesla

Executable exe 1c96e7dac7927d86bce37d67c33dd37d337a310b48f17819904f7082a9632678

  
Dropping
MD5 23cb2601bc6731846108f280af4af6a1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c96e7dac7927d86bce37d67c33dd37d337a310b48f17819904f7082a9632678

Comments