MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a
SHA3-384 hash: 5e3ffb7d8bd86c6b70d2b73438db07f8604c432ce73aab063f908eb092cd14aa2505fa46c8730f935fe1a3ee765c2bc1
SHA1 hash: c47a81e6b69087839cfd15c90d35bdad9f17adb0
MD5 hash: 525a984ef974736cb81d2aa34a9b8be7
humanhash: river-winter-july-north
File name:8100OJ.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:588'081 bytes
First seen:2020-07-10 06:50:35 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:GR8PMNpvyRCplaoAcOMEn3gI8kO+IHLnqHr68hv4:GR7NpQC6Pc2nwI8D9qJg
TLSH 3AC423FE5EA588DCEA281D33EEA44749C7B416782512E7AC0DCF362784C2559FB770A0
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: naver.com
Sending IP: 45.138.172.58
From: Hei Ryung <sales_ljimports@naver.com>
Reply-To: Hei Ryung <sales_ljimports@naver.com>
Subject: LJ Order
Attachment: 8100OJ.r00 (contains "8100OJ.exe")

AgentTesla SMTP exfil server:
mail.ashpraskills.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 06:52:06 UTC
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4hmlg4meev7j32h7zz4wgol2o7oni66gsvaq6a4paczcjq3hjfva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e1d8b37184257e9de8ffce7963397a77dcd47bc695410f038f00b224c367496a

(this sample)

AgentTesla

Executable exe 04c7c046518196b6b88e6b3860d870e1ad21728353d8e73f23a9276a1a5e211f

  
Dropping
MD5 bfbdaa4f58a5fb04b5ebd07df65d794c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04c7c046518196b6b88e6b3860d870e1ad21728353d8e73f23a9276a1a5e211f

Comments