MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b082eb2ba3f16793c35e6f95f71f146b35b1d45957c099be4dd5b5052790707f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b082eb2ba3f16793c35e6f95f71f146b35b1d45957c099be4dd5b5052790707f
SHA3-384 hash: 523062851937efd4362b6f259e52f2fa1d9d362053bf4b77fdd1591404d01ab8c9809f56036f60fe46679b97ccf2e070
SHA1 hash: d400e2ed4e633ea915130986be7456a9bc2265c5
MD5 hash: 41a335791291f3fb5d8bf4da95998d62
humanhash: glucose-virginia-river-mockingbird
File name:SPECIFICATIONS AND 3D DRAWING.pif.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'379 bytes
First seen:2020-05-25 12:36:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dHS2tvKKrAC7bStUOUzDa2rxXO7RJgG3a:ZScCSe+ZY77I
TLSH CE8423684337B901A9B83197807C678958CE766EACDDD2853CA6BC8F4BC5546BF023F1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-729369.hostwindsdns.com
Sending IP: 142.11.196.208
From: PROCUREMENT SUPERVISOR <bistro.ltd@bistro.com>
Subject: YOUR BEST AND MARKET FRIENDLY QUOTES ON THE PRODUCTS ATTACHED
Attachment: SPECIFICATIONS AND 3D DRAWING.pif.rar (contains "SPECIFICATIONS AND 3D DRAWING.pif.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:37:01 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b082eb2ba3f16793c35e6f95f71f146b35b1d45957c099be4dd5b5052790707f

(this sample)

AgentTesla

Executable exe c986ab8fb7125210b901bf41a288cc4adb017de55b803b78b48c8061e8e94565

  
Dropping
MD5 48f96035bf4e74f2238095039b032c57
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c986ab8fb7125210b901bf41a288cc4adb017de55b803b78b48c8061e8e94565

Comments