MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67e3f9d8839ad64dc3db99dbc1322e940889cfa449ab3ed7fb0ea861c51bb830. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67e3f9d8839ad64dc3db99dbc1322e940889cfa449ab3ed7fb0ea861c51bb830
SHA3-384 hash: 3f13c38dc06d66a45895aa2e79047888e902dba8e9b2bb192a6ad8faf3ea86cef32616b85999767cb67855b1b75e28ba
SHA1 hash: afff9260b166b8e4821d9027c1e7048a0a2c4966
MD5 hash: bd2f66c29b9c8b2ca921e9f8fc473edb
humanhash: coffee-beer-triple-jig
File name:P O.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'143 bytes
First seen:2020-06-20 07:46:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:hYxO6HZ3KA7tHytmQB64RgQtXnz/QoXiZsq1x9PhK6lLMyB0w1PAiGBTzYUn/O:WTIAhyQMgQtXnzlq1/nofw1PzGjG
TLSH A18423DEE203C988192E55632A9705C6348572B5A7CAFE103C25ED5EB7D3CB1E844BBC
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: oasispublicity.com
Sending IP: 95.211.208.50
From: lee<info@oasispublicity.com>
Subject: RFQ 705125 - PR 197087
Attachment: P O.rar (contains "P O.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 18:37:00 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7r7twedtlle3q63thn4cmrosqeitt5ejgvt5v73b2ugdri3xaya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 67e3f9d8839ad64dc3db99dbc1322e940889cfa449ab3ed7fb0ea861c51bb830

(this sample)

AgentTesla

Executable exe 6b235c788e8bbad0830c2538cb10ef06839266c038111465ef369f3dec323dc9

  
Dropping
MD5 b0032273dfb59b3db1fef35dafaf8ba2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b235c788e8bbad0830c2538cb10ef06839266c038111465ef369f3dec323dc9

Comments