MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c42fbca528bd28c6d94ea8c1026b62c1d65c5a5a413affb0f72f01cb2d2a5e17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c42fbca528bd28c6d94ea8c1026b62c1d65c5a5a413affb0f72f01cb2d2a5e17
SHA3-384 hash: f51ea023c0dd977527c531f05dee784b901acbe744f148277ebf875791ee539675cebb4e2ad4dd9d2f93c91578c06951
SHA1 hash: c5441a5b78c3282feda46c11aa5e53533138719a
MD5 hash: 3587f5617bfc645f8e6f3cb0ee59c566
humanhash: michigan-don-sad-helium
File name:QUOTATION_REQUEST_PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:675'584 bytes
First seen:2020-07-20 07:18:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:25HBOh1t3k5+7D8TZIi5irf61fkN7iuAMirX3RN8FUSd/JOBbO2AGjKbIk+XaKi8:25HBOPbD8lISi+1fk5lViThoxpJOW9bs
TLSH D4E4230334AB9DEC7E5E99D27983F970D0A887E59BC8C19FE352133BA6C30D28741565
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv.kucukofis.com
Sending IP: 94.237.90.68
From: Laurels Brent <reservation@memoiredangkor.com>
Subject: Quotation Request
Attachment: QUOTATION_REQUEST_PDF.rar (contains "QUOTATION_REQUEST_PDF.exe")

AgentTesla SMTP exfil server:
mail.bosut.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c42fbca528bd28c6d94ea8c1026b62c1d65c5a5a413affb0f72f01cb2d2a5e17/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 07:20:09 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqx3zjjixuumnwkovdaqe23cyhlfyws2ie5p7mhxf4a4wljklylq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c42fbca528bd28c6d94ea8c1026b62c1d65c5a5a413affb0f72f01cb2d2a5e17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c42fbca528bd28c6d94ea8c1026b62c1d65c5a5a413affb0f72f01cb2d2a5e17

(this sample)

AgentTesla

Executable exe 1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf

  
Dropping
MD5 f69261837f9da67ec44f9162d322b7ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf

Comments