MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98c93aa86a635a231a5db9f6e3d02e7ad987e2443c0de62975592d8ae9d72b97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98c93aa86a635a231a5db9f6e3d02e7ad987e2443c0de62975592d8ae9d72b97
SHA3-384 hash: 14f8229e33b088d1f37582ae8060ed40f2ca4cdb98f520bcea39c7cfa35efa065106dce11d84f8b8b54048f0ad64d92a
SHA1 hash: aef67d5efd1ae114b9da1cdda9f6dc6fa2f5277b
MD5 hash: 2ad5b29e2946e3d2ad34b499b9501e44
humanhash: princess-kansas-apart-arkansas
File name:Atlantic RFQ.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:510'738 bytes
First seen:2020-08-13 08:31:43 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:SwDGJMEwVGLSIzUOwZNtTTjG8E3xv62db:SwDSMEwVGLhdutTTDYd
TLSH C1B4239F714AA1E756F3E443677D3D75B02085B7224E22F3E9214EB842CBE6A8889174
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zero06.nayana.kr
Sending IP: 218.145.71.174
From: Doug Russell <manoj@msvfabrics.in>
Subject: Urgent quotation needed for ADNC 2020 project
Attachment: Atlantic RFQ.Gz (contains "3eNP2LJg4vSTsvu.exe")

AgentTesla SMTP exfil server:
smtp.lettu.us:587

AgentTesla SMTP exfil email address:
hr@lettu.us

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98c93aa86a635a231a5db9f6e3d02e7ad987e2443c0de62975592d8ae9d72b97/
Threat name:
ByteCode-MSIL.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 08:33:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdetvkdkmnncggs5xh3ohuboplmypysehqg6mklvlewyv2oxfolq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/98c93aa86a635a231a5db9f6e3d02e7ad987e2443c0de62975592d8ae9d72b97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 98c93aa86a635a231a5db9f6e3d02e7ad987e2443c0de62975592d8ae9d72b97

(this sample)

AgentTesla

Executable exe 294cf2895407982e76f245557284a2c6eec761afd0d00d79dd30564a87a9bac0

  
Dropping
MD5 1481c0abbc4d624b0deb8ccac1568b91
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 294cf2895407982e76f245557284a2c6eec761afd0d00d79dd30564a87a9bac0

Comments