MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f
SHA3-384 hash: e8408ccd3a11ca502e2c271f0d3858cfb0fdad460eb40a2bac2e8e780b9ead2a6ca3c6bcb64a1393c5e753fd3d58453f
SHA1 hash: b8b778f9ed7e93c2b3ddeb364747c1bf578da758
MD5 hash: f5c198b180bcece77f9e857e332d3851
humanhash: emma-princess-video-september
File name:Purchase Order MG-PO-15719.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'407 bytes
First seen:2020-05-22 10:05:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Qv7W7fzu+OS3o8GGp97F/ikw2wGXruHUK6IUChUov+/f2OuiCUPDcA2iKVc0:Qafzu+KXGp3/EZIy0Iv+X2OFCADcTL
TLSH 9784230A1EB247FEF6F058448FC1880B518A17FECB383C749A5D84D48A9BA5753E07B6
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kore.dnskore.com
Sending IP: 195.22.8.68
From: Ahmed Hamsa <info@zahrawigroup.com>
Subject: Revised P O
Attachment: Purchase Order MG-PO-15719.rar (contains "OGh90TJnFCLq82I.exe")

AgentTesla SMTP exfil server:
smtp.almahidtechtop.top:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 10:37:02 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f

(this sample)

AgentTesla

Executable exe e36592e55db1b574420d878db8af79b5bdffe0be9c0829da0457c1cd78399110

  
Dropping
MD5 27502b908538097a379d6bf984d45e70
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e36592e55db1b574420d878db8af79b5bdffe0be9c0829da0457c1cd78399110

Comments