MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99294e6d078fff0a424a75a8bf56556032ff7c3c975829a782a6eaf9dc3867d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99294e6d078fff0a424a75a8bf56556032ff7c3c975829a782a6eaf9dc3867d6
SHA3-384 hash: 1b677a027ce91a6a2f5d28a81a6fddd9d6112ad162fd09ee368c8e5dd6d5ad30cdfe39a32b7b848835c8e94815cc4c24
SHA1 hash: 69f5b74ef5d33b926f01da0a8aad59aadcd17dc1
MD5 hash: 6e55007e9425a93b539469289744e78a
humanhash: video-arkansas-social-illinois
File name:P.O 650047 Maheen Label Tex Ltd Maheen Dizayn Etiket BD. Ltd.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'042 bytes
First seen:2020-08-12 15:40:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:87i/px7ne4z4HBqk7n0KU8jDEI1gXNabbPUF267c:8e/rKCM0t0IqrqY
TLSH D7942314659D10299DC58266FBBF21F94D922C6AC33EE6FACC7C42CD887598281F2DD3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: scorpio.atomiclayer.com
Sending IP: 96.125.179.170
From: Kobeco JOHORE <assesin@singnet.com.sg>
Reply-To: costamagnaluciiano@gmail.com
Subject: Purchase Order 650047 Maheen Label Tex Ltd & Maheen Dizayn Etiket (BD.) Ltd.
Attachment: P.O 650047 Maheen Label Tex Ltd Maheen Dizayn Etiket BD. Ltd.rar (contains "P.O #650047 Maheen Label Tex Ltd & Maheen Dizayn Etiket (BD.) Ltd.exe")

AgentTesla SMTP exfil server:
mail.kohinoorribbon.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99294e6d078fff0a424a75a8bf56556032ff7c3c975829a782a6eaf9dc3867d6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 15:41:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=teuu43ihr77quqskowul6vsvmazp67b4s5mctj4cu3vptxbym7la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99294e6d078fff0a424a75a8bf56556032ff7c3c975829a782a6eaf9dc3867d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 99294e6d078fff0a424a75a8bf56556032ff7c3c975829a782a6eaf9dc3867d6

(this sample)

AgentTesla

Executable exe dce254811aa1fb718c9212489cc1dfe76a579d3bb3363758188021ab6843295e

  
Dropping
MD5 867b6dcc94da3f06f2fc0830365d0345
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dce254811aa1fb718c9212489cc1dfe76a579d3bb3363758188021ab6843295e

Comments