MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73e8bd74258eb0eb1894e247134c1a5844defa08f764afd1ab8574def809f796. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73e8bd74258eb0eb1894e247134c1a5844defa08f764afd1ab8574def809f796
SHA3-384 hash: 8572595d6f335f3a6574f15d7e1cbfd18b006946bba5ef44154a4d7689b6da5b483a5ff62bae8205220835187c37e198
SHA1 hash: bcd5c8fe1841072f98d7c87d2d138cef60772d82
MD5 hash: 32cc0d2c83c3d1178a20d41c1e03ae34
humanhash: ohio-don-maryland-berlin
File name:PO-7700754.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:515'977 bytes
First seen:2020-06-11 06:24:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:+Yk0KkZ2YFRm46maSol2VwfpkZJKm10JAo:+VkxcfywfaZJT10yo
TLSH 7CB423D9D96387D7A3CD0501513FA3BF59FAA15E170DE230E7422EA98E77A6E0401F0A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 103.99.1.173
From: CHANDRA KANT <rite4chandrakant@gmail.com>
Subject: RE: Requirement for the month of June PO # 7700754
Attachment: PO-7700754.pdf.rar (contains "#PO-7700754.pdf.exe")

AgentTesla SMTP exfil server:
mail.pro-powersourcing.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:26:10 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=opul25bfr2yowgeu4jdrgta2lbcn56qi65sk7unlqv2n56aj66la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 73e8bd74258eb0eb1894e247134c1a5844defa08f764afd1ab8574def809f796

(this sample)

AgentTesla

Executable exe f514c4bf21f409ca78f25d0d5e945605a777ff96884b8bf2d34ce54cffbc3409

  
Dropping
MD5 a4af14175ab92c0b3f586657843aab47
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f514c4bf21f409ca78f25d0d5e945605a777ff96884b8bf2d34ce54cffbc3409

Comments