MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bed206b790f2cef7fb445cd501d4977ca58850d4889cbe936b6326dce861cfcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bed206b790f2cef7fb445cd501d4977ca58850d4889cbe936b6326dce861cfcb
SHA3-384 hash: f0e5c1b093a533c84d20855c1b562b4c24a3ca9a85404e410d28b1c62bba16affc8acb637e7b6000b1e1cb25a5264dfa
SHA1 hash: 02177571f1b3550ca8531364560f83384984cda7
MD5 hash: 0849c2ad028ab5f13d447ab39e37da92
humanhash: massachusetts-arizona-mockingbird-magazine
File name:UPdated_SOA.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'575 bytes
First seen:2020-08-03 13:23:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:WdY7K6r9wDwfOr64xyRX9iQvOQq4YSFV7l19eruIqxto:Wmr9wDeOrARXkQ2QqnSD71aFqxy
TLSH E8C4231A8BF005306D63C76AA0A6D7E2805BEFF99CF49363E3D2BA2045535725E0DB47
Reporter abuse_ch
Tags:AgentTesla Raiffeisenbank rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.dizaynnet.com
Sending IP: 136.243.77.54
From: Raiffeisenbank <mobilyamuhasebe@tetrihome.com>
Reply-To: helpdesk2811@yahoo.com
Subject: STATEMENT OF ACCOUNT - JUNE/JULY
Attachment: UPdated_SOA.rar (contains "UPdated_SOA.exe")

AgentTesla SMTP exfil server:
mail.pkstyles.pk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bed206b790f2cef7fb445cd501d4977ca58850d4889cbe936b6326dce861cfcb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:25:05 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3jann4q6lhpp62eltkqdvexpssyqugurcol5e3lmmtnz2dbz7fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bed206b790f2cef7fb445cd501d4977ca58850d4889cbe936b6326dce861cfcb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bed206b790f2cef7fb445cd501d4977ca58850d4889cbe936b6326dce861cfcb

(this sample)

AgentTesla

Executable exe ab13f3cf7de54784a1fe4cb2957e019ce6c9564c63eb11f42b4ee80762e51179

  
Dropping
MD5 a637661f202c7adc40abb283158dadbb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab13f3cf7de54784a1fe4cb2957e019ce6c9564c63eb11f42b4ee80762e51179

Comments