MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e34f6d2cf3f23f91432f845a6a74e6bbced2811fc6c1a9a47bac0ae2d5647498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e34f6d2cf3f23f91432f845a6a74e6bbced2811fc6c1a9a47bac0ae2d5647498
SHA3-384 hash: 7d28ad49136304ef5621c8b25ad51bf9eebe66bd22a59f2d78b3af7fed55237add88a977a111a3fb0dec8913e1d68b17
SHA1 hash: 95d85d9f9dfb10453e68da2d2835d0f7232dbec1
MD5 hash: 506ad645888fa917113d93026f791cd2
humanhash: fanta-washington-mexico-illinois
File name:order-4947.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'394 bytes
First seen:2020-06-19 09:51:00 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:XvMMfzU9uLiYWnsAcRACBAD57+5t1kaBW:9zU9uLvWnvcpQN81kaBW
TLSH BF842325B75FD9806FFFE88C09BDD8D42810BF04051550928F5EADAC1A7DA6B0AE7393
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.arminco.com
Sending IP: 109.68.120.153
From: Mohammed Younis <supta@cbn.net.id>
Subject: PURCHASE ORDER NO..4100014181
Attachment: order-4947.r00 (contains "order-4947.exe")

AgentTesla SMTP exfil server:
mail.fedefruta.cl:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-19 09:52:06 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4nhw2lht6i7zcqzpqrngu5hgxphnfai7y3a2tjd3vqfofvleosma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e34f6d2cf3f23f91432f845a6a74e6bbced2811fc6c1a9a47bac0ae2d5647498

(this sample)

AgentTesla

Executable exe 347db9c4bdf1d2c8b000b26237cac303b91983f5454fb72c73763c611a87fc47

  
Dropping
MD5 a2934864fc1122c670cd7dfc00657e9d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 347db9c4bdf1d2c8b000b26237cac303b91983f5454fb72c73763c611a87fc47

Comments