MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddebb1e036c8d9e07c81fba26bf755248bc89122b0cdadd05e42199bc0896842. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddebb1e036c8d9e07c81fba26bf755248bc89122b0cdadd05e42199bc0896842
SHA3-384 hash: ac22b82faff188c3dd7736407d702ff768ef1673da5f080b791de88a1921d37e1feb3d99adde6c6ea470fcf0d4582c6a
SHA1 hash: 4b5b80c80909d2861564f6053b77be76f9e6fae8
MD5 hash: 2b42fcf931c492908150b82ba0717e6f
humanhash: nuts-floor-virginia-yellow
File name:RFQ.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'109'942 bytes
First seen:2020-07-07 12:42:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:6N1RIM1mDIXGKcvFyDR0sk2j91HlP0qcD4T5oyV+EJLww9zLbR:6rRIMUVKfKs5DTb8EJdLbR
TLSH 84353340A42D1EA338E43FDCD791E3394F4BC25E869052E5CD17C2A5764AF26D9EB84C
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [103.140.250.133]
Sending IP: 103.140.250.133
From: TOTAL MARITIME SERVICES LTD <purchasingdept.totalmaritime@outlook.com>
Reply-To: purchasingdept.totalmaritime@outlook.com
Subject: REQUEST FOR QUOTATION.
Attachment: RFQ.rar (contains "Items.exe")

AgentTesla SMTP exfil server:
mail.cka.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddebb1e036c8d9e07c81fba26bf755248bc89122b0cdadd05e42199bc0896842/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 12:44:10 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xv3dybwzdm6a7eb7orgx52vesf4rejcwdg23uc6iimzxqejnbba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ddebb1e036c8d9e07c81fba26bf755248bc89122b0cdadd05e42199bc0896842

(this sample)

AgentTesla

Executable exe 9c5da09379aac3c9b0c5fe8dbca524809a1109f2e57b218b5f48b9f2e32a4bf0

  
Dropping
MD5 1460fb4b266589b7b04d24d4da9a1f92
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c5da09379aac3c9b0c5fe8dbca524809a1109f2e57b218b5f48b9f2e32a4bf0

Comments