MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd651332966ba38c76296138d84b8649afdc18d425730344c9f68c252a617deb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd651332966ba38c76296138d84b8649afdc18d425730344c9f68c252a617deb
SHA3-384 hash: 1936acea218f88e95400cf5828e39c889ff74da6caff9f01d1d42a7c89c5b04f04b84c610d60e0c3cfcf3d360700671c
SHA1 hash: 2fa6a2532b6d5581c19a8902bcf30c5007e73393
MD5 hash: f054416d9bdf48702221fedbb49437e7
humanhash: hawaii-harry-pennsylvania-football
File name:NEWORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:346'644 bytes
First seen:2020-05-19 14:25:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:H+sOKf5qKbw675pizuzQHtP/zwDQyur4A4bAkKTrQ/rAyi+43XjL5l9kpEmG+aoA:H+sOKxqwbD8Xz9y1J81IzdynjKr+dL
TLSH 8C74236F503B9048E21CEBD1CF3660A5D0D3FCD945AD71878BA1DC76A23A87E1849AF1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.nevasys.com
Sending IP: 81.23.104.214
From: KIM <info@toyohashi.ed.jp>
Reply-To: abs000010@outlook.com
Subject: New Order Request
Attachment: NEWORDER.rar (contains "NEWORDER.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:37:17 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvsrgmuwnoryy5rjme4nqs4gjgx5ygguevzqgrgj62gckktbpxvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cd651332966ba38c76296138d84b8649afdc18d425730344c9f68c252a617deb

(this sample)

AgentTesla

Executable exe 9b32d4574a87d93cd8a86c06826574e2e2fd3646333890beaece710e8613be62

  
Dropping
MD5 749ad1faae8562b4f65f1b279b1234c2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b32d4574a87d93cd8a86c06826574e2e2fd3646333890beaece710e8613be62

Comments