MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f948636a2d2293d485cf58d5a03cc975d17344453fc38ebaf52b0074f469695. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f948636a2d2293d485cf58d5a03cc975d17344453fc38ebaf52b0074f469695
SHA3-384 hash: ad54204f5f0e8953a2ece7e3cf7939aff877c222047aeaefc57ba1a2175c15d82eb2cf47bfde039e1e3f597d33da54f2
SHA1 hash: dfb1a12efc48cc61bc9b73a255839d574e289aa4
MD5 hash: f7f04cf9cc9e4b8bc0abbcff0b717ad2
humanhash: three-jupiter-fish-equal
File name:Order_4768945.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:896'228 bytes
First seen:2020-06-18 18:33:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:29usHuLNu0Ic6TaE62VtXbD0178280o6WkDq7/YF/S9:UuTLVQdbD0j8Rqq7/wS9
TLSH 591523DE0F13C8E1C95BF1D3C49C929186C1F9B21D797220A719864932F9E9F687C4BA
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.161
From: Alberto Penafiel <opr6.ae@absaco.com>
Subject: URGENT PURCHASE ORDER
Attachment: Order_4768945.rar (contains "Order_4768945.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 13:37:15 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6kimnvc2iut2sc46wgvua6ms5oroncekp6dr25pkkyaot2gs2kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9f948636a2d2293d485cf58d5a03cc975d17344453fc38ebaf52b0074f469695

(this sample)

AgentTesla

Executable exe 888a23aef242f26dcfdbe6591715d698ad3b1ed16b8946b31ff7e44da3ddead3

  
Dropping
MD5 25971cb7135f98d8c5d2856fe69e0979
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 888a23aef242f26dcfdbe6591715d698ad3b1ed16b8946b31ff7e44da3ddead3

Comments