MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc8cc7e42d70eed8c2a4dab7edb321261ef72aa4c37c68f5ac2d9001436209aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc8cc7e42d70eed8c2a4dab7edb321261ef72aa4c37c68f5ac2d9001436209aa
SHA3-384 hash: 09f87da4c7a8113463c9f21d375ce97ea438474e8c5ea03efc22b6014d7e0b252c41a87adf09e60fbbc987bbd5d957a0
SHA1 hash: d4375faec0eb78f9f478a7fff18a53691a5acb24
MD5 hash: 639e7918dd2a995bb53817e80cfe4866
humanhash: leopard-gee-finch-montana
File name:RFQ.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'120 bytes
First seen:2020-06-12 07:51:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:moiiHMHAShWrcbO7lMffZEBh5mh8YXfifem5uJYOEYKwusZtLxzMqe+Lh:RBUXQ8E/5mGkafem5eoYPuKzMfSh
TLSH 8F8423F360B12666084284D7CC1B567E4D695A263C03B7CB99B1F285B1BC9F065F4BCE
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gdi.com.qa
Sending IP: 45.153.242.228
From: Shahid Hassan <shahid.hassan@gdi.com.qa>
Reply-To: Shahid Hassan <anita.morgan09@yahoo.com>
Subject: RFQ 705125 - PR 197087
Attachment: RFQ.rar (contains "RFQ.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 07:45:16 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xsgmpzbnodxnrqve3k363mzbeyppokveyn6gr5nmfwiacq3cbgva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bc8cc7e42d70eed8c2a4dab7edb321261ef72aa4c37c68f5ac2d9001436209aa

(this sample)

AgentTesla

Executable exe f8e184f76b586ee06075217550923bca1450cde335435718fb21a82e27729163

  
Dropping
MD5 a043db0c5e2fd1a7f216082ca3d097c4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8e184f76b586ee06075217550923bca1450cde335435718fb21a82e27729163

Comments