MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 868371f43750a220436752772191807ff40cb738cfd82b043f0851b4d6410144. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 868371f43750a220436752772191807ff40cb738cfd82b043f0851b4d6410144
SHA3-384 hash: 84431339439d4e95717e0e371c465e4c8cc345281ce3e3ee4b122fe9fc71ba74f8975d99478fcd6f828ca91e8fe2fc13
SHA1 hash: b836cfb6165402ca932fbad8bb94fcc66dd6be1d
MD5 hash: 41b86aea598076bb1663277604d67a8e
humanhash: ink-foxtrot-freddie-ack
File name:Objednávka 4500049021.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:495'261 bytes
First seen:2020-06-03 10:50:32 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:YhjCAs6XNKcAN9Qy9/fTBwErdbLuHUW8xIqDy2/9:w1DXN7AN1/fTBwErJiHUpIYy2/9
TLSH A5B42390872D2A725F66872A34872DDCBCD93F1DB92499BE3753561F6DE830B4724320
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mxload.webglobe.sk
Sending IP: 212.57.32.37
From: marianna.huckova <esivakova@mlproduktion.sk>
Subject: Objednávka 4500049021
Attachment: Objednávka 4500049021.arj (contains "Objednávka 4500049021.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:02:00 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
13 of 31 (41.94%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2bxd5bxkcrcaq3hkj3sdemap72aznzyz7mcwbb7bbi3jvsbafca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 868371f43750a220436752772191807ff40cb738cfd82b043f0851b4d6410144

(this sample)

AgentTesla

Executable exe 4bba94a55fd3800882705fe28738040cb2e439c1ccd41d5d28af6844148411f5

  
Dropping
MD5 39fb4a5324a3a6235382d24422255726
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4bba94a55fd3800882705fe28738040cb2e439c1ccd41d5d28af6844148411f5

Comments