MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f1afb25e9c01b138ddeaf87358256a4b082525440929ac2a5f599b2cfde4ccd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f1afb25e9c01b138ddeaf87358256a4b082525440929ac2a5f599b2cfde4ccd
SHA3-384 hash: c226f3f3edb3de4bb0a6bf16b42dc1218a8ffd6de65ef9a3a59372a4dd92036772c5a31c613516e083f38e5ccb28fa3e
SHA1 hash: a7f081569715aad1df6f8dbb5515f1491626f5a5
MD5 hash: 4531e33ec969a8fe11f4cba715dab486
humanhash: jig-emma-sad-venus
File name:RFQ 073120.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'657 bytes
First seen:2020-07-31 06:09:02 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:qTOxigQuxz7wXmwvEUDuSCOeTX4/KrOQISams5:qTOxik9Gvtu2KrOsams5
TLSH A5942343FBD6A1E59F688D5A3535C6DCC348677AF6DD82211621C08907EF2B1D88437B
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Tim Lu <admin@shanghaicentury.com.sg>
Reply-To: Tim Lu <linda-dobrinskibrothers@mail.com>
Subject: New RFQ QDS9483_CTS
Attachment: RFQ 073120.r00 (contains "RFQ 073120.exe")

AgentTesla SMTP exfil server:
smtp.autoshorp.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f1afb25e9c01b138ddeaf87358256a4b082525440929ac2a5f599b2cfde4ccd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 04:41:38 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4npwjpjyanrhdo6v6dtlaswusyieusuicjjvqvf6wm3ft66jtgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8f1afb25e9c01b138ddeaf87358256a4b082525440929ac2a5f599b2cfde4ccd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 8f1afb25e9c01b138ddeaf87358256a4b082525440929ac2a5f599b2cfde4ccd

(this sample)

AgentTesla

Executable exe 891a9376f1d8e1a80995a4139e8b06e1cd2c9f8ae41e10203863be9944e743ac

  
Dropping
MD5 68660e9a96ee227889f3fabdf0f08cf1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 891a9376f1d8e1a80995a4139e8b06e1cd2c9f8ae41e10203863be9944e743ac

Comments