MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad392ea7803093dd12b9654fc9edd55a1833473016208caaf54b77bf8ec8a311. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad392ea7803093dd12b9654fc9edd55a1833473016208caaf54b77bf8ec8a311
SHA3-384 hash: 3dfd39bebcf9b94269af46b3d174727229b0696591f793222063915485c0a2ecad85d85f320f32d9a187246a745043af
SHA1 hash: 697bfafd9eb22b7900e1d93a607449f1c3800185
MD5 hash: c6fb3c877159a0da51e9b0dd48d338a5
humanhash: twenty-colorado-four-mango
File name:SAN RAMON GENERAL TRAD. CONT. CO KUWAIT.ORDERLIST.PDF.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'527 bytes
First seen:2020-06-16 14:32:30 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:/pKFXy2XMzcQ5DMvBpsqHRELayysJNavPqLA+MO4Bpnz80wSKzkm8t3vvtSds:/pIC2XM/5DgpsLLayysqyU+YkzH8dXR
TLSH 029423884681166822157716C6FB8DE57BC430077FA6DB06382F26DF8DDC4A726C9DDC
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gettyengin.xyz
Sending IP: 142.93.204.171
From: Abdulrahman Al-Eissa ON BEHALF OF SAN RAMON GENERAL TRAD. & CONT. CO KUWAIT <office@gettyengin.xyz>
Subject: SAN RAMON GENERAL TRAD. & CONT. CO KUWAIT. ORDERLIST
Attachment: SAN RAMON GENERAL TRAD. CONT. CO KUWAIT. ORDERLIST.PDF.r00 (contains "SAN RAMON GENERAL TRAD. & CONT. CO KUWAIT. ORDERLIST.exe")

AgentTesla SMTP exfil server:
mail.kalatecnic.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 14:34:04 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu4s5j4agcj52evzmvh4t3ovlimdgrzqcyqizkxvjn337dwiumiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 ad392ea7803093dd12b9654fc9edd55a1833473016208caaf54b77bf8ec8a311

(this sample)

AgentTesla

Executable exe 0d92da4fa2fd3b7ebb74b5bcfe7d824031cbfce983d96684a3552b482f07cbb8

  
Dropping
MD5 2a7d460e344efffc9dbb4ea5c883394d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d92da4fa2fd3b7ebb74b5bcfe7d824031cbfce983d96684a3552b482f07cbb8

Comments