MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbeef4a9d0fb891932d3bc0a69268f9908a36c58af1fc4013943ae5fe6e4876d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbeef4a9d0fb891932d3bc0a69268f9908a36c58af1fc4013943ae5fe6e4876d
SHA3-384 hash: 18a18a825e5a8b4a2f5a175cc1b7a16bea57ef61c4fc90033755209c8e9fbdd2c534522b4c0853a40eac5178558563be
SHA1 hash: 8ef1786a738306ed1a9af18cfc5ebfd3db07df05
MD5 hash: 3f42d2f1ba64e56947ea22d8a23bac9a
humanhash: stairway-autumn-vegan-india
File name:BANK LETTER DOCUMENTATION pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'231 bytes
First seen:2020-06-15 12:45:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:TUqVc3tbJuqAu5fMEAuNYFhnMBr/cVuGOCm:jVcRJbAu5kEAuKFlMBSuD
TLSH 639423B39874BBA70E0FA5D8E83B0B4381533DA9F352F167360456B38F869514A477B8
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: araltextile.com
Sending IP: 37.48.85.240
From: RITA<info@araltextile.com>
Subject: RE:Final Payment/Balanced Payment Copy[SWIFT COPY]#085634
Attachment: BANK LETTER DOCUMENTATION pdf.rar (contains "BANK LETTER DOCUMENTATION pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.CryptInjector
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:47:03 UTC
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3pxpjkoq7oersmwtxqfgsjupteekg3cyv4p4iajzioxf7zxeq5wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dbeef4a9d0fb891932d3bc0a69268f9908a36c58af1fc4013943ae5fe6e4876d

(this sample)

AgentTesla

Executable exe 9356f38f03d8b08b94502798482bcc96fa4a5f47f6f67c5bff879d1ec13480d8

  
Dropping
MD5 52a0afd1b255cfb0fc3ccad6416cbbb1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9356f38f03d8b08b94502798482bcc96fa4a5f47f6f67c5bff879d1ec13480d8

Comments