MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daea3d388a69a86412d2c437f1a4fab7e8d0911df7061c570b346cbfa5cdde50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daea3d388a69a86412d2c437f1a4fab7e8d0911df7061c570b346cbfa5cdde50
SHA3-384 hash: 671b07e3fdfe6f4477bf064b636d3b21e07bda5f9abbd08541eaacf2f3e1b79651cec91112ebd65938629b92da80d2c8
SHA1 hash: a9e6af4c310663e5ca69a4803d1d4a84f44bc2d3
MD5 hash: 280ce5b6a139fd11dd345b3f51987360
humanhash: bravo-comet-autumn-artist
File name:Order_List July-2020.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:479'819 bytes
First seen:2020-07-09 07:57:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:6NeKjvvYQ/+YUOZNHQTwozTSZ7qNuafPFqfxO5j6CZ7I:WbJ/pUO/QwovSZ7qNu4PUfxMjf7I
TLSH EBA423AF56A8F2F3562A0E47DD8304B64CAB9B5CCBE4F091217E44961EC953C6CE08D7
Reporter abuse_ch
Tags:AgentTesla Endurance r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: sales@belbev.asia
Subject: New Request Of Price Offer For Your Products / SHIP TO SINGAPORE
Attachment: Order_List July-2020.r11 (contains "Order_List July-2020.exe")

AgentTesla SMTP exfil server:
smtp.desmaindian.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/daea3d388a69a86412d2c437f1a4fab7e8d0911df7061c570b346cbfa5cdde50/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 07:59:04 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lvd2oekngugiewsyq37djh2w7unbei564dbyvylgrwl7jon3zia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar daea3d388a69a86412d2c437f1a4fab7e8d0911df7061c570b346cbfa5cdde50

(this sample)

AgentTesla

Executable exe c4c50cf3bc3e1096a29ec0c968224cd64a080a34322d2f7d27a75d2f992cd29d

  
Dropping
MD5 20da25eaf3a27483c08e99120b868454
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c4c50cf3bc3e1096a29ec0c968224cd64a080a34322d2f7d27a75d2f992cd29d

Comments