MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4f1f270800e34b842c9e086ae4fd777ba9dd7aa06b079fd857499303bf89f73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4f1f270800e34b842c9e086ae4fd777ba9dd7aa06b079fd857499303bf89f73
SHA3-384 hash: 3b8d07b83956e4fc832ac026ab37e2437db03171859ff4d0af5f90ac5040e69d57abaccf25deefc129a91eba3c26b856
SHA1 hash: 4a854047057190ed45e89b158126028634f02bc6
MD5 hash: 6fca31494c36cf92ed24a824f45f6dd3
humanhash: orange-paris-item-lemon
File name:HONEYWELL RFQ.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:995'907 bytes
First seen:2020-06-02 10:21:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:r4gSBjW2pLNu0Ic6ACvq49Ks5kXobC37KJ1ZX74kpdcVYK:MHBWILnw9KcE2XsL
TLSH F825330C5DE7667C389E2BC5CCB9FD1654CB0E52AD2AFD68D9EC0C67A7138C8B848494
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: uropfobisendi.live
Sending IP: 45.153.240.63
From: Honeywell Process Solution Malaysia<info@uropfobisendi.live>
Reply-To: info@raasworld.com
Subject: RFQ Reference:7893234OM/RFQ/01/June 2020
Attachment: HONEYWELL RFQ.rar (contains "HONEYWELL RFQ.exe")

AgentTesla SMTP exfil server:
mail.radianthospitals.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 10:37:18 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ty7e4eaby2lqqwj4cdk4t6xo65j3v5ka2yht7mfosmtao7yt5zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4f1f270800e34b842c9e086ae4fd777ba9dd7aa06b079fd857499303bf89f73

(this sample)

AgentTesla

Executable exe 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b

  
Dropping
MD5 6389ad387f9c82d8ca43e1040cb65341
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b

Comments