MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c794448d78838fcbce7c1997306ebbe3f775bb3f4ec015a2df6ed150201ec62e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c794448d78838fcbce7c1997306ebbe3f775bb3f4ec015a2df6ed150201ec62e
SHA3-384 hash: 50e6c23d7faf7cd81d4db34b2101c911821bf77d47090c0420898c23e20a54b9c51420dd25879f9ed3b5f0b8d5369772
SHA1 hash: 48431bb2455de636db77a31add1dffa864c81bc8
MD5 hash: 30734540faaa653c0d77b634b2f78eff
humanhash: charlie-edward-enemy-undress
File name:Order Specification.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'824 bytes
First seen:2020-06-06 09:34:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:1nmHk8pOm6X1Q1G9Nn2AQhWLjQCjmRwjk+9XCJFGySaJELiHjfLOK:Ok8n2QwdiErcwjBXCJYySaJvjTOK
TLSH C584237989B37AF35035859CFD9E5E1BF2AC4E28145891F0DAC3AC17E3B408919E23D6
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.lajdhdk.gq
Sending IP: 89.32.41.174
From: Rajesh Arasu <admin@lajdhdk.gq>
Reply-To: harishguptmaya@gmail.com
Subject: RFQ#13-Order Inquiry
Attachment: Order Specification.rar (contains "Order Specification.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 08:01:48 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6kejdlyqoh4xtt4dglta3v34p3xloz7j3abliw7n3ivaia6yyxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c794448d78838fcbce7c1997306ebbe3f775bb3f4ec015a2df6ed150201ec62e

(this sample)

AgentTesla

Executable exe b13c91ec09a119b6a1bfbbe0efc0576b84c56d6dbfa21ff946594b677bddfa68

  
Dropping
MD5 8954c0d5100b6a857d9d608a548212fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b13c91ec09a119b6a1bfbbe0efc0576b84c56d6dbfa21ff946594b677bddfa68

Comments