MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 850401e802cda69b6c41f6d8ad72caa0edae16d632c59b812c48bf16442abea9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 850401e802cda69b6c41f6d8ad72caa0edae16d632c59b812c48bf16442abea9
SHA3-384 hash: 5ec172478bfda1733eb472ac7a29459e876abcd1e3fa8766545d3660ae2e2e351a6b1aba699702e414923dceac17181a
SHA1 hash: 77b58036c66ff2fd76af3d49a3e55414516913ae
MD5 hash: fa34beefcccb2944a283c3b302bc3a47
humanhash: nevada-queen-jupiter-purple
File name:Statement of account.pdf.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'768'007 bytes
First seen:2020-05-06 07:30:09 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 49152:JehGJdbM96lvqdqIgwPy9LqT9sLhbXQ8K09fW:JehsdQ96pne+LhbXQvCW
TLSH C185333AD009235FE09499BCE368F4F25896295FF05E8FB45ACB11F7B720059960A1FB
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: china-ilife.com
Sending IP: 188.241.58.204
From: Xu Ming <sales10@china-ilife.com>
Subject: 账单
Attachment: Statement of account.pdf.r00 (contains "Statement of account.pdf.exe")

AgentTesla SMTP exfil server:
mail.parmanand.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 07:38:32 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qucad2aczwtjw3cb63mk24wkudw24fwwglczxajmjc7rmrbkx2uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 850401e802cda69b6c41f6d8ad72caa0edae16d632c59b812c48bf16442abea9

(this sample)

AgentTesla

Executable exe cfec0ab7a50fc4721607da3a019dfe9d8ff2bde1f771f26ffba9fbd42738f16b

  
Dropping
MD5 80ebbe32db9eefd9c16ad4109f3a4fe9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfec0ab7a50fc4721607da3a019dfe9d8ff2bde1f771f26ffba9fbd42738f16b

Comments