MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bba98848836a18bcf1f0764cf0c4acabe92211e48b7105b803d3e9938550cec5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bba98848836a18bcf1f0764cf0c4acabe92211e48b7105b803d3e9938550cec5
SHA3-384 hash: a403b1f99ac974250e09421f962f3e4fa3215fdbd1505c8268b644c00089a7d5fbd13aa9fde0124a418f0f942da8f35c
SHA1 hash: 7cbe2e3fcb2c7d85107fa644110381e0e7361f42
MD5 hash: 9383fa3e4959c7287212b3f58ca71af7
humanhash: november-arizona-lima-lactose
File name:Urgent Order.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:533'554 bytes
First seen:2020-08-06 05:23:40 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Zr5bANdPJ9TH5iOXGysMzt45KO9xWNT4fJuM6DKTkhBZLwWlGb:zyJ9TH5i6GysMu5KO9xuc6NL0b
TLSH 28B423BA74CA031AD7697D6166575C20F3D0A0B28A7BFE437F3BD3D4DA122B47940688
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outmx-267.london.gridhost.co.uk
Sending IP: 31.170.120.152
From: Andy <sale01@farletza.com>
Reply-To: Andy <Ventas@imagencolor.cl>
Subject: Re: August Order
Attachment: Urgent Order.r00 (contains "Urgent Order.exe")

AgentTesla SMTP exfil server:
mail.ppmm.or.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bba98848836a18bcf1f0764cf0c4acabe92211e48b7105b803d3e9938550cec5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:25:12 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xouyqsednimlz4pqozgpbrfmvpuseepernyqload2puzhbkqz3cq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bba98848836a18bcf1f0764cf0c4acabe92211e48b7105b803d3e9938550cec5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 bba98848836a18bcf1f0764cf0c4acabe92211e48b7105b803d3e9938550cec5

(this sample)

AgentTesla

Executable exe f5f9766b693142ae58adab4bd6f0e1491994de6e9c5d605e655e0e2ef507a46f

  
Dropping
MD5 9e4dd47db3d85e6ba1cf108f1808624c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5f9766b693142ae58adab4bd6f0e1491994de6e9c5d605e655e0e2ef507a46f

Comments