MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d36e644b4978a3b0782034797a9e4a0aa599cd253226f0770ba15352a3d91d27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d36e644b4978a3b0782034797a9e4a0aa599cd253226f0770ba15352a3d91d27
SHA3-384 hash: cdd2b2b35d4d84a4de2be90295a7624934a4cd438ef19c815feab81dba5fd506011dc1642095c4a73e9f4f10f623d72a
SHA1 hash: 832e32cc670fa778f7ecd72c3fc79ca3cd250d30
MD5 hash: dc68afe6398955f94634a24b74c075e6
humanhash: pizza-pluto-five-venus
File name:ALHOSN TRADING EST PO 2020000190.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'060 bytes
First seen:2020-07-05 10:04:13 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:qtCXOG0tUzdny2VdhQBP+j4kpIN+me412RIjc:+C+7UBVdWBPK4kp/meRmjc
TLSH E08423C0C9388FA3FB68BAE0B5B55A5DFB1BC2341150CAF0A592857408D20D5EFE6397
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pulsar.qst.es
Sending IP: 45.128.8.20
From: Mohammed Jafer <mohd.jafer@alhosntrading.com>
Subject: Purchase Order No. IPO-2020000190 SFD ALHOSN TRD. EST
Attachment: ALHOSN TRADING EST PO 2020000190.r00 (contains "Purchase Order No IPO 2020000190.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d36e644b4978a3b0782034797a9e4a0aa599cd253226f0770ba15352a3d91d27/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-05 10:06:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2nxgis2jpcr3a6bagr4xvhskbkszttjfgitpa5ylufjvfi6zdutq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d36e644b4978a3b0782034797a9e4a0aa599cd253226f0770ba15352a3d91d27

(this sample)

AgentTesla

Executable exe 5eb9b4d6d7e12e2b605adb64d332ec0ef196520106ee561a99b528c7f82f49ef

  
Dropping
MD5 1a59dcf84d48e81820fa6151c575e03d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5eb9b4d6d7e12e2b605adb64d332ec0ef196520106ee561a99b528c7f82f49ef

Comments