MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3c514d8211111c8b8af752590937303d86395ba3a7f528f4dd5e466c0d578f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3c514d8211111c8b8af752590937303d86395ba3a7f528f4dd5e466c0d578f9
SHA3-384 hash: 4acc12a941e27798bcb226775c53cca55a6f638a18e2bd31bcfa706e18461e916e99caac392c38acb242709d8422df1b
SHA1 hash: 064471b3f8d3018d7f463d37ab46bd63e8771d36
MD5 hash: 3788361da77b5b3bdc21be07a818cb53
humanhash: diet-don-aspen-missouri
File name:SKMC_31052020106325_8307737263945.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'001'149 bytes
First seen:2020-06-01 19:52:23 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:zQ0ztToYOV2c9h+z9BNZibic6mTIqYibNOZ1gSb:zQ0REvAbz/N4bic9TJYibA
TLSH BF25335CF4A93C57FB087D297A1314AA62371C89716C22E0F23B075DA3950ED2CBBB55
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dmrgumruk.com
Sending IP: 156.96.45.138
From: muge@dmrgumruk.com
Subject: RE: Sales Order
Attachment: SKMC_31052020106325_8307737263945.r00 (contains "SKMC_31052020106325_8307737263945.exe")

AgentTesla SMTP exfil server:
mail.brightpackaging.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 20:36:24 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pcrjwbbcei4rofpouszbe3tapmghfn2hj7vfd2n2xsgnqgvpd4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d3c514d8211111c8b8af752590937303d86395ba3a7f528f4dd5e466c0d578f9

(this sample)

AgentTesla

Executable exe c38316df2aa65caafcd887fe22d31d654066eb67df3e1de19e7dadfc9a47c839

  
Dropping
MD5 0c564e03a8b5af193ed968a39e5cc732
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c38316df2aa65caafcd887fe22d31d654066eb67df3e1de19e7dadfc9a47c839

Comments