MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b37f594034e0c14f84be030a07fd87a03b68bf9e1403b05f50aa5fb36317a8f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b37f594034e0c14f84be030a07fd87a03b68bf9e1403b05f50aa5fb36317a8f7
SHA3-384 hash: b7c5f114777c296a2d45550d85f8e30a6ae61739c58a06c01b4efc81193d24d988658ca2f6b10fa638532e5461264c01
SHA1 hash: 17e79f49191959be715e57183ea0fee976785293
MD5 hash: ee38d08ddbbc2a18dd405e81eb787154
humanhash: mobile-video-mike-eleven
File name:RFQ-20-QAI-PRJ-0051-UNITED ENERGY.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:389'996 bytes
First seen:2020-06-28 09:13:09 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:+Veoe163gxQBpWdB9jA8xd0xaVkHJe04aZMvmHJV6WwQtm10bdk8ChhT/4L9:+soQ8WL9jfpdJjuHJwWwQtma8hqL9
TLSH 748423F351C0EEAA1E7350CFCB4747ABB93EC1953527931C9E4017E5A8E6022A399B5C
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cosmo.securesvr.net
Sending IP: 139.99.69.157
From: Vivek Dinesh Shah <s.vdinesh@sonangoliraq.com>
Reply-To: Vivek Dinesh Shah <mahdi_bashii45@yahoo.com>
Subject: RFQ-20-QAI-PRJ-0051 - United Energy
Attachment: RFQ-20-QAI-PRJ-0051-UNITED ENERGY.arj (contains "RFQ-20-QAI-PRJ-0051-UNITED ENERGY.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b37f594034e0c14f84be030a07fd87a03b68bf9e1403b05f50aa5fb36317a8f7/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wn7vsqbu4dau7bf6amfap7mhua5wrp46cqb3ax2qvjp3gyyxvd3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj b37f594034e0c14f84be030a07fd87a03b68bf9e1403b05f50aa5fb36317a8f7

(this sample)

AgentTesla

Executable exe 65f2622026a29f02d0785f3fa3d3ef2a26aff0681acceb61bc72e8ecca5ff07e

  
Dropping
MD5 124586b0a240403c4fde259a8f3cf840
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65f2622026a29f02d0785f3fa3d3ef2a26aff0681acceb61bc72e8ecca5ff07e

Comments