MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73da0f0ba52b2961753486f2e16d0218eafc5f0bae6c6c87707a414c5649e1fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73da0f0ba52b2961753486f2e16d0218eafc5f0bae6c6c87707a414c5649e1fd
SHA3-384 hash: 1cbb598cf28cf6e7337eb9ab545bdf391cae680126be6ccf1d00836e737617ea3b8e38af5f0b49d981416eff08f8084e
SHA1 hash: 855a241d1da1a72e2067e171cfb6faf5ee561b92
MD5 hash: cd34e8daad39b2df0bbeea9028394725
humanhash: johnny-oklahoma-johnny-alpha
File name:New Order 3452_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:379'630 bytes
First seen:2020-04-29 17:49:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PTE0cE1HY9ks1ydZIAiuic8snWHkGKkGIkCgPvx/i8od+eqobI6MdxBf8z56uPz:PD1Hls1yD98HEbxCgHx/c+eBr+xo6i
TLSH F38423D1E5B70CD7B1C7431E6D76E2A0A873E4111AC1CCB96036A93773F6AB76205E28
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ansamcal.com
Sending IP: 209.58.149.66
From: Purchase/Rolf Mayer <purchasse@ansamcal.com>
Subject: New Order #3452 / 04-28-2020
Attachment: New Order 3452_pdf.rar (contains "New Order #3452_pdf.exe")

AgentTesla SMTP exfil server:
mail.nabf.com.au:587 (122.201.97.187)

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 18:36:01 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=opna6c5ffmuwc5juq3zoc3icddvpyxylvzwgzb3qpjauyvsj4h6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 73da0f0ba52b2961753486f2e16d0218eafc5f0bae6c6c87707a414c5649e1fd

(this sample)

AgentTesla

Executable exe e4edb75adeeb77973b20f4e65a287125f2a12d53e9a1ab647d5737234bcfbd70

  
Dropping
MD5 97a10e16153cbde02389462546c1003b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4edb75adeeb77973b20f4e65a287125f2a12d53e9a1ab647d5737234bcfbd70

Comments