MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceab85d6980fd704b1f68e798ce32224dd63c04844361e6436a90a2cf9305cb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ceab85d6980fd704b1f68e798ce32224dd63c04844361e6436a90a2cf9305cb8
SHA3-384 hash: acd1af406ac9285f0c3f0c70fbe2727d6257748295100941c7f86fde4e2d0393cd9e4dda46139410458703672bb3c108
SHA1 hash: 9185124ce45bd5a69f7e3738c45928a7947368f8
MD5 hash: 154ea3a838b6467acf059832de62d1a3
humanhash: king-tango-emma-mountain
File name:RFQKAIDI INTERNATIONAL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'758 bytes
First seen:2020-05-12 09:11:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sJiPYu8a8xStniBeTVnV9auFAQfwFJJTK67:s7/BeTVV9Zj4FDd7
TLSH FB9423D9A0B239DA8CD53538B1BAB248C80EDF97271C35D0A3DE9A54B51A312F6F44F4
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.livezone.org
Sending IP: 85.196.164.46
From: "PANAN CORP CO.,LTD." <dpa@meteorship.com>
Subject: ORDER & KG5-3824
Attachment: RFQKAIDI INTERNATIONAL.rar (contains "RFQ#KAIDI INTERNATIONAL.exe")

AgentTesla SMTP exfil server:
mail.hayasansor.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 01:54:22 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2vylvuyb7lqjmpwrz4yzyzcetowhqciiq3b4zbwvefcz6jqls4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ceab85d6980fd704b1f68e798ce32224dd63c04844361e6436a90a2cf9305cb8

(this sample)

AgentTesla

Executable exe f134ea682b658d440872d3bee407f639781cc715e9427942bbf896db8822a112

  
Dropping
MD5 c6a0ef5cedb9e8e634089b5b93b707ad
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f134ea682b658d440872d3bee407f639781cc715e9427942bbf896db8822a112

Comments