MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2acae8a5ce465fc0242d27df91d426d0b01a9669226efc569c2e9dafc3c3f25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2acae8a5ce465fc0242d27df91d426d0b01a9669226efc569c2e9dafc3c3f25
SHA3-384 hash: b8a6dcd437f9c1c6a6af38dea3c9cebfc18348d2fdd7b69343932f6ee2a78c7851d385ce37231869de20e5422599f33c
SHA1 hash: 597fa803e0bcf510546a8db84bcea557d99c6700
MD5 hash: 9678cf8a0b8ea99da9484e479a5cf076
humanhash: lithium-ceiling-hawaii-fanta
File name:PPEs Purchase PO768598.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'494 bytes
First seen:2020-05-06 09:47:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:64csutAaMWvySHdWjHqFRK5rPwtmPJVakqAa:64csfaAsWzq+Pwi8ZAa
TLSH FBA423CB493F62E33101D9248CAEEACF66961CE5DD3C12D06245DCB4F7B26D2DA74A90
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway36.websitewelcome.com
Sending IP: 192.185.184.18
From: info@kilowatteng.com
Subject: AW:INADPHARM Bulgaria , Purchase Order
Attachment: PPEs Purchase PO768598.rar (contains "PPEs Purchase PO#768598.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:37:02 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kwk5cs44rs7yasc2j67shkcnufqdklgsito7rljylu5v7b4h4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d2acae8a5ce465fc0242d27df91d426d0b01a9669226efc569c2e9dafc3c3f25

(this sample)

AgentTesla

Executable exe f5a541e463d4446bbe18d539e3fc65ee4fd0319aedfef463f7b03332d05a34d5

  
Dropping
MD5 c2d7812b2ac35e35bc9deaddc36846e6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5a541e463d4446bbe18d539e3fc65ee4fd0319aedfef463f7b03332d05a34d5

Comments