MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1ca246f057701686f150ee98ded36fef0f8514f71e64e89ae6e8b657c11509d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1ca246f057701686f150ee98ded36fef0f8514f71e64e89ae6e8b657c11509d
SHA3-384 hash: 1146d808acff084d06ae7475e14121b0c5a42e26dad3ea3408bcda06a16916ba9543a4ae016b6d68a50c5d84f8e3c541
SHA1 hash: ab87e8181d9df8d7db398c910ea5fa0aba6c7f22
MD5 hash: 833d251357fafb78bdffaf2f157d630e
humanhash: hawaii-double-fish-missouri
File name:SOA.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:257'522 bytes
First seen:2020-05-04 17:54:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:wCKnCMjbFzbJrrGFvgGw5pmJWrGJxyZ0ZoTGMLJYFdRYh1LiEgxp7V8c3Od0YCRL:FqCsJ/GFBApm8rQgKdMsdRYH+VPAuL
TLSH 154423DCC8952B9C3EEF59870B849D5F240B51ECFE285E7E4228229A48F537417CB92D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-186187.us-west-1.nxcli.net
Sending IP: 173.249.144.83
From: ASAT ELECTRICALS <fadel.shanti@eud.ae>
Subject: SOA FOR PAYMENT PROCESSING
Attachment: SOA.rar (contains "SOA.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 05:12:22 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yhfci3yfo4awq3yvb3uy33jw73ypqukpohte5cnon2fwk7arkcoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c1ca246f057701686f150ee98ded36fef0f8514f71e64e89ae6e8b657c11509d

(this sample)

AgentTesla

Executable exe 14943405df4eda0b52a991c719154f2b6d5c87f92589d489481b194995771421

  
Dropping
MD5 6f113178aa4bda0a61d87a1aa7778d61
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14943405df4eda0b52a991c719154f2b6d5c87f92589d489481b194995771421

Comments