MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af718e9960eedaf8c50838f9ee72ae9993f912e0d929585bf9c312f888c009a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af718e9960eedaf8c50838f9ee72ae9993f912e0d929585bf9c312f888c009a8
SHA3-384 hash: c6eeec699b889681861b421cc3fdec6436d992604e4becaa18b2c819470eeb4f1bc9fd05ac2230a59c88f1e5074dfc2c
SHA1 hash: 307cd2300fe30c19e91fa98fbfbeab9ef94b4335
MD5 hash: 3be5c716284c354b5240b37136422860
humanhash: ink-oregon-johnny-echo
File name:NEW PO.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:519'760 bytes
First seen:2020-08-06 05:44:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:tO2z6dENnEA0yYGY/VO2z6dENnEA0yYGY/b:Ud8EA0yYGjd8EA0yYGK
TLSH 17B423F94A5A303904574BDDF2FB0D76E02A36226BDA7D65418BCF419382BBE604837D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [103.140.250.133]
Sending IP: 103.140.250.133
From: Lu Thai Textile Co Ltd <luthai@ltc.com.cn>
Reply-To: luthai@ltc.com.cn
Subject: NEW PO.
Attachment: NEW PO.rar (contains "NEW PO.exe")

AgentTesla SMTP exfil server:
mail.indiaflanges.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af718e9960eedaf8c50838f9ee72ae9993f912e0d929585bf9c312f888c009a8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:45:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v5yy5gla53nprriihd4644votgj7sexa3euvqw7zymjprcgabgua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/af718e9960eedaf8c50838f9ee72ae9993f912e0d929585bf9c312f888c009a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar af718e9960eedaf8c50838f9ee72ae9993f912e0d929585bf9c312f888c009a8

(this sample)

AgentTesla

Executable exe 9efe7e30ea15e98bd89bd340662d1c23a37efe66af1eec0275a7138b043cae37

  
Dropping
MD5 9aeddbf569161fb4611075244a03a4aa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9efe7e30ea15e98bd89bd340662d1c23a37efe66af1eec0275a7138b043cae37

Comments