MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bd0557f45b1d8f632e6055f537d52a866d4524401508c14b07ab6b1dd9af631. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bd0557f45b1d8f632e6055f537d52a866d4524401508c14b07ab6b1dd9af631
SHA3-384 hash: 9b17c18625237fd6f4c11dd26f43d8fb0560a2508398c2d53f5225b6b674bcc87ac2803dfedb00ffc148e2cde453f11f
SHA1 hash: f6d9660cf67bd0f85d3f30277c56e70df15810c1
MD5 hash: 3fbbab1a550ab6244116a8de3a6f2e14
humanhash: papa-harry-july-fourteen
File name:Doc_767467JUNE2020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'282 bytes
First seen:2020-06-15 12:39:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8yZNMDkPfjHDLo09ThTHz/+/vzoPODZd9C7RxP8QwEEIV9:NZNSq40HPeEPC1C7PP8TTIV9
TLSH 2284232647419B97B2F741CC79AE7810B684C9325550ABE3F5018086F2EF0EE6DDBAF1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gki.com
Sending IP: 37.49.224.124
From: Stephen Rice <steve.rice@gki.com>
Subject: RFQ: Renda & Biggs Well Station Bid
Attachment: Doc_767467JUNE2020.rar (contains "Doc_767467JUNE2020.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:41:05 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rpifk72fwhmpmmxgavpvg7ksvbtniuseafiiyffqpk3ldxm26yyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8bd0557f45b1d8f632e6055f537d52a866d4524401508c14b07ab6b1dd9af631

(this sample)

AgentTesla

Executable exe 0189ad2e08f8bb4c487e31502a7e86ccf2bfaba40fda638f316cb5c9ca80d767

  
Dropping
MD5 8ac061125c6771c56f990211fbcaf819
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0189ad2e08f8bb4c487e31502a7e86ccf2bfaba40fda638f316cb5c9ca80d767

Comments