MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b00adc70457b067fba8f4c129ed6a6d1cf26337de18c76ff6cf39265e92e5046. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b00adc70457b067fba8f4c129ed6a6d1cf26337de18c76ff6cf39265e92e5046
SHA3-384 hash: b98d110322a053ab278f0afcac03f0e5e38933153293fffd53e2d03b0cc051343900bdacf44df3983381f790524fc180
SHA1 hash: fa3cee8cf848b15c16404c630558e79942ea2efe
MD5 hash: b291ec095c2bf2ad4b7d669480b1f5ee
humanhash: fruit-glucose-fifteen-river
File name:Payment Advice.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'176 bytes
First seen:2020-06-16 12:15:27 UTC
Last seen:2020-06-16 12:20:26 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:FU6QFRxJy7FYG7gJGlpVhKz33OgkPlrADElsKvU2Fh4gh6:SdRxJyR/UJAprKz3egk9/smh4Y6
TLSH DA94234EE0B653AEB1ECCB121D24D8B606C240ACFA5465D9F16CC1ACE2DF16F4366F60
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: resourcedm.com
Sending IP: 185.222.58.143
From: contact <sales@resourcedm.com>
Subject: Re:Payment Advice
Attachment: Payment Advice.pdf.rar (contains "Payment Advice.pdf.exe")

AgentTesla SMTP exfil server:
smtp.ahrass.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 12:17:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wafny4cfpmdh7oupjqjj5vvg2hhsmm354gghn73m6ojgl2jokbda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b00adc70457b067fba8f4c129ed6a6d1cf26337de18c76ff6cf39265e92e5046

(this sample)

AgentTesla

Executable exe 3433b1bcefaae32b48fd99528d3aac6056a71e1892224069f26754c96451425d

  
Dropping
MD5 6524f2c7565212a3e7ded78a560692ee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3433b1bcefaae32b48fd99528d3aac6056a71e1892224069f26754c96451425d

Comments