MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c11f7ca91b504e7f3418e7729819e3230d715528b50ef36ddec9659dbb511374. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c11f7ca91b504e7f3418e7729819e3230d715528b50ef36ddec9659dbb511374
SHA3-384 hash: d67fa74267d879ec3874d9e60593d4e875e905fb4b1a2101d356554cf7c3f82144f9149987590f37205f73eb266ccd01
SHA1 hash: 047f26c0cb8c0ea3a3662e4b87348bb9c35bc207
MD5 hash: 8250a694a50c3c626e80a3c01c1d92b6
humanhash: kilo-wisconsin-ceiling-illinois
File name:Purchase Order.docx.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:365'591 bytes
First seen:2020-07-07 09:21:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VamiN8VR4TRw1PdmmfVDYr729oIucs/44Fe0QNxnIOsx2FGRe1N65h6kfp8F:U1yJdltkrC+Iucs/rFQNxnIOhQ6650Ic
TLSH 2E74239B69871785D260E2A90A1C61E3359F14121E3C6EF3750ABD9C38B5D6B1CA3F03
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: atomicka.localdomain
Sending IP: 202.52.134.122
From: Dickie Chung <samundeswari.k@milekniran.com>
Subject: New Purchase Order No.( PO-191119-02837)
Attachment: Purchase Order.docx.rar (contains "Purchase Order.docx.exe")

AgentTesla SMTP exfil server:
smtp.rezuit.pro:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c11f7ca91b504e7f3418e7729819e3230d715528b50ef36ddec9659dbb511374/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:23:04 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yepxzki3kbhh6nay45zjqgpdemgxcvjiwuhpg3o6zfsz3o2rcn2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c11f7ca91b504e7f3418e7729819e3230d715528b50ef36ddec9659dbb511374

(this sample)

AgentTesla

Executable exe 065e273108079c4ff07c0cd84a59d91d0219f058b1088305c35500f69a09a77c

  
Dropping
MD5 c074adc0631666808d35a3c7e07eac5c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 065e273108079c4ff07c0cd84a59d91d0219f058b1088305c35500f69a09a77c

Comments