MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeb11ac61956a8095e8d9e23c68c19e4d28d69bdf2f2bcc6ee7ce1536b4fd42f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeb11ac61956a8095e8d9e23c68c19e4d28d69bdf2f2bcc6ee7ce1536b4fd42f
SHA3-384 hash: 1d60dad168a5e79349f4ed759abaaafc8059ce61918a9c6a21fb32a4236b5cbc8a8a5f2c217db6d1756ccb192fdd50ba
SHA1 hash: cc7cd9467b783066717d8eefb5e0fb38897058c3
MD5 hash: 565f00f044b8100fbd3fab59221ddf6d
humanhash: crazy-tango-washington-zulu
File name:PURCHASE ORDER for Manifold Cap for Green Mile.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:380'832 bytes
First seen:2020-06-16 13:04:23 UTC
Last seen:2020-06-17 06:44:15 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:hc2Yw4OcbnjumIZxeND0fRqiQ8Bd8TRk30dBN9ETWHzcdOiNPDNokcj3Kt2wKfdX:DYiIGkNDJiX8TRk30db9/HgOYN7OO2wi
TLSH 7F842365C256B59BCDAFC84A05BE0A557CB0DBE2CD8B099CC942A3F76134F3E21B0746
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alumayerindia.com
Sending IP: 103.99.1.170
From: milindalumayerindiac malve<milind@alumayerindia.com>
Subject: PO # 4400028298~~~~ IMPORTANT~~~~~
Attachment: PURCHASE ORDER for Manifold Cap for Green Mile.rar (contains "PURCHASE ORDER for Manifold & Cap (for Green Mile).exe")

AgentTesla SMTP exfil server:
mail.microtechlab.in:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 13:06:05 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2yrvrqzk2uasxuntyr4ndaz4tji22n56lzlzrxoptqvg22p2qxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar aeb11ac61956a8095e8d9e23c68c19e4d28d69bdf2f2bcc6ee7ce1536b4fd42f

(this sample)

AgentTesla

Executable exe 3a3c09351e3e036e5ae4189d1337fd0e2add6df2985e589508b936428d5c903d

  
Dropping
MD5 c744482e3060eb14521ab111ee2334ad
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a3c09351e3e036e5ae4189d1337fd0e2add6df2985e589508b936428d5c903d

Comments