MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d535734e8144b6188cae79b31f8238f624fae231bbc74e7f880b058f83f0c342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d535734e8144b6188cae79b31f8238f624fae231bbc74e7f880b058f83f0c342
SHA3-384 hash: a374608796785e4483e0758391a52ffc19d035e1a3c4074fd28224aa240097c9437fcfef75690f2186c6dced2b323c47
SHA1 hash: 5183be5845782f58ae9bc3d180303a6a6ef0b6d7
MD5 hash: a6c93a481fd8a3d61ac309bc6c9f3aab
humanhash: queen-robin-equal-xray
File name:Purchase Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'883 bytes
First seen:2020-08-13 06:50:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GNbcdFvZrIx3bbZzJPq32r8GmiYB8/AkD9UjEdkPtLGseYEm:V/Ixr9JPg8/ToYXYv
TLSH C7C423D734FAE3BA4421E4B0359D9E9A261A4341E21DDF8B36CF14C8406BE8DB58E770
Reporter abuse_ch
Tags:AgentTesla rar Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic312-25.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.69.206
From: Tony Johnson <ranohl71@yahoo.com>
Reply-To: Tony Johnson <tonyjohnsone1@gmail.com>
Subject: purchase order
Attachment: Purchase Order.rar (contains "9jxMRauSjg3F0JX.exe")

AgentTesla SMTP exfil server:
smtp.annlap.com:587

AgentTesla SMTP exfil email address:
huverteamup@annlap.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d535734e8144b6188cae79b31f8238f624fae231bbc74e7f880b058f83f0c342/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 06:52:07 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2u2xgtubis3brdfopgzr7ary6yspvyrrxpdu474ibmcy7a7qynba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d535734e8144b6188cae79b31f8238f624fae231bbc74e7f880b058f83f0c342

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d535734e8144b6188cae79b31f8238f624fae231bbc74e7f880b058f83f0c342

(this sample)

AgentTesla

Executable exe 7ba4bab9ee682598fdfb031a1fa88105eaa1ff29a3d7c3e053a2c69e6b496660

  
Dropping
MD5 018f2ebe2fe04ef64699cdc10d9ef382
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ba4bab9ee682598fdfb031a1fa88105eaa1ff29a3d7c3e053a2c69e6b496660

Comments