MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9452e70017eb6ea709c39e8a42cdecc1932c261430ec6f8ae10d15ef247be185. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9452e70017eb6ea709c39e8a42cdecc1932c261430ec6f8ae10d15ef247be185
SHA3-384 hash: fdc5e9b293d13d762f382f64a397ba33fa6f1663b46cd2e5137b2acf1ede644afe4e37eb8c4348fa985c507ddae32ba9
SHA1 hash: a42a3d3308de57c05ce2066dcd6b5b2d1c291884
MD5 hash: a9b7a83e2ed7d453fb433a9ef7b03401
humanhash: berlin-london-purple-crazy
File name:PURCHASE ORDER.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:946'357 bytes
First seen:2020-06-16 12:50:09 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:aDsUhUnrywKb+n0GsmRiLvnA+W7EwevzCVKRb:OWn2Kn0bmwLvnhwsz/
TLSH EE1533B4996A12211E1E7E72D6AC9FB963558D2CF1A07C2CDCC23F8796D0FA3146352C
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aida-machinery.com
Sending IP: 95.211.208.50
From: PURCHASE<amy@aida-machinery.com>
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.r00 (contains "PURCHASE ORDER.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 12:52:05 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=srjooaax5nxkocodt2feftpmygjsyjqugdwg7cxbbuk66jd34gcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 9452e70017eb6ea709c39e8a42cdecc1932c261430ec6f8ae10d15ef247be185

(this sample)

AgentTesla

Executable exe bca37ddb3330991ff40fdc9462eebaf28b8cca2ee0a3c89b4102517c77d2dae8

  
Dropping
MD5 f315ec23b5a581845fea692174b46232
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bca37ddb3330991ff40fdc9462eebaf28b8cca2ee0a3c89b4102517c77d2dae8

Comments