MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4cdb3ad0815b36da036a3e6561dcb1679dd203cb84210e8bcdc7777303f2ff7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4cdb3ad0815b36da036a3e6561dcb1679dd203cb84210e8bcdc7777303f2ff7
SHA3-384 hash: 08dc13cb6cd5fc8b9a203a0e62d62cd01f342a3728dfeea558b96048e86861aed8f6cb18eed7e5c7fca12458422e8bd1
SHA1 hash: 1d1650f5a9fdd5f3df426f1d431c5bb28b4ba1c4
MD5 hash: e28ff737701f069ebc333f0521e2318c
humanhash: one-finch-robert-quiet
File name:ITR-FORM-V-2020-2021.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:357'055 bytes
First seen:2020-06-18 12:49:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:g19os7QGhTeWLfGWpyETpFV8ExboYTA9eyBSAeyvQ1lnWLmajyJTxtkXPs+OZQ:g1QGhSWLfGmPfTg9ehMQbnW6ajg96fs0
TLSH B1742313EBA67C7E4B95753BA58E7026C15279A44F54E2C668C083CAB1057D2E3F32D3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pilot.superhosting.bg
Sending IP: 195.191.149.26
From: DONOTREPLY@incometaxindiaefiling.gov.in
Subject: Urgent/NEW REFORM INDIAN IN INCOME TAX RETURN
Attachment: ITR-FORM-V-2020-2021.rar (contains "eKQlGDugLCD1gdM.exe")

AgentTesla FTP exfil server:
ftp.mrgladvogado.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 13:36:34 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtg3hliicwzw3ibwuptfmholcz452ib4xbbbb2f43r3xomb7f73q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b4cdb3ad0815b36da036a3e6561dcb1679dd203cb84210e8bcdc7777303f2ff7

(this sample)

AgentTesla

Executable exe d3a6a76acace927a7049f9123cf25dc126eac27e8700dbf95abe6133018a9b52

  
Dropping
MD5 c49d66bbbe29154033c323a20c60f55a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3a6a76acace927a7049f9123cf25dc126eac27e8700dbf95abe6133018a9b52

Comments