MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a849afac51cca1c209360307f8c690e47933374415f8a9eff505e9eac745da82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a849afac51cca1c209360307f8c690e47933374415f8a9eff505e9eac745da82
SHA3-384 hash: 3fcd8f26a7ffb7714a25eeb9c2c8610c977e946d6de6abd5441d5d1adaaa005e3f9e9906755277dc75606f78d70d7cfb
SHA1 hash: 6a2d58ffcee4e34e8eaf1541b1ef10a8dff47b75
MD5 hash: 9d14a630faaebb5642786902d5bd2b25
humanhash: burger-kilo-montana-cold
File name:orden pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'261'662 bytes
First seen:2020-05-14 06:07:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:CJSe2MKRSuRKTGde40u4s4GtdCREGFfx1RXrFJQ6NJhWV:6Sf7gTGdef5RE0fPTJJc
TLSH 8B45338DCF149038D343826C9B4BED9D830E8B9966C0BD6DEE4ABC4C42595CE2F5AE54
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bosmailout01.eigbox.net
Sending IP: 66.96.184.1
From: sventas@assic.com.mx
Subject: RE
Attachment: orden pdf.zip (contains "orden pdf.exe")

AgentTesla SMTP exfil server:
mail.kapackserv.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 06:37:17 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vbe27lcrzsq4ecjwamd7rruq4r4tgn2ecx4kt37vaxu6vr2f3kba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a849afac51cca1c209360307f8c690e47933374415f8a9eff505e9eac745da82

(this sample)

AgentTesla

Executable exe 01c8966718aa1996c3b0460be4df08ec32e4a17af72a27947060a6fc07c7455f

  
Dropping
MD5 d79a3d40595bc4f0c0d8fe98302ab7cb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01c8966718aa1996c3b0460be4df08ec32e4a17af72a27947060a6fc07c7455f

Comments