MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1ea81a905f81f78871c80cac2366dd65ba84f8ceb8341f36236ba605ab073dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1ea81a905f81f78871c80cac2366dd65ba84f8ceb8341f36236ba605ab073dc
SHA3-384 hash: 42ac1fe3bc20588398742a2c3b4aab90e011118dd641f1b753489dab5cc31a86577a16a263a2d5bb6b11d3fd9f1820df
SHA1 hash: 0fb9f06c95513a1606e18da8c82cf07b4b25c771
MD5 hash: 9bc89058b3001dc85c789bb543606968
humanhash: river-north-vegan-snake
File name:Documents.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'724 bytes
First seen:2020-04-21 16:52:28 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:9l+n7X/54zFqOxw+ZgPK847kGomQMGRbovd:D+n7h4NO+2PKgthy
TLSH 698423F9C618D48499ACDA17AA77AD3DB0B33042833BC9FF9D3AD11889CD96551F281C
Reporter cocaman
Tags:AgentTesla r00


Avatar
cocaman
Malicious email
From: Purchase-6 <rud-division@alkuhaimi.com>
Received: from alkuhaimi.com (unknown [212.32.245.155])
Date: 21 Apr 2020 09:29:32 -0700
Subject: Order

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 17:35:30 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4hvidkif7apxrby4qdfmentn2zn2qt4m5obud43cg25gawvqopoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e1ea81a905f81f78871c80cac2366dd65ba84f8ceb8341f36236ba605ab073dc

(this sample)

AgentTesla

Executable exe dd7f48c1ecdd7e81096156acf24f705e0040277150037fe54b008f59da3a07a8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd7f48c1ecdd7e81096156acf24f705e0040277150037fe54b008f59da3a07a8

Comments