MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e233e7985417c3b7290c5891d97772189a40ec355e13208b462d40b172a345a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e233e7985417c3b7290c5891d97772189a40ec355e13208b462d40b172a345a9
SHA3-384 hash: bab00d67c790890d233dd32260a28665d109b496c5b1d204a556f20eb1d6bee7583884597dc6b568b0e9d7681a788439
SHA1 hash: 6592c40b03a94a2c99849e4f74df9726db41fc4d
MD5 hash: 4bc8c1831dccbe85589719a377ae5231
humanhash: network-cola-uncle-oregon
File name:RFQ20-173_pdf.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:982'957 bytes
First seen:2020-06-10 13:59:08 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:oZc/I3qNFjm7iXHLMfZOVliUp60xqcVjsSJIIUSXUvogkLASgWH7QBvvYUWrsZNB:oZOjS+MAiU88o2DXuWHcvosZNwCX
TLSH 712533448E1351B170DA0EA353A94E9AC935903CD8F7793FC2EFED659A7243BA41D0AC
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.neurer.ro
Sending IP: 91.212.101.153
From: Diego Matías <relacionconproveedores@pemex.com>
Subject: PEMEX // Price Offer - 10.06.2020
Attachment: RFQ20-173_pdf.r01 (contains "RFQ20-173_pdf.exe")

AgentTesla SMTP exfil server:
mail.brymormaks.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 14:01:03 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4iz6pgcuc7b3okimlci5s53sdcneb3bvlyjsbc2gfvalc4vdiwuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 e233e7985417c3b7290c5891d97772189a40ec355e13208b462d40b172a345a9

(this sample)

AgentTesla

Executable exe 1092ba232edafd491a8ad63ef0d2ac15062307df6527e3ac717f43973c596589

  
Dropping
MD5 4a11d3088d2f90e528b57495087884fc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1092ba232edafd491a8ad63ef0d2ac15062307df6527e3ac717f43973c596589

Comments