MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f08214ead269150c1a141586771739c8425cfe20d872f4ccc320e156f9389c50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f08214ead269150c1a141586771739c8425cfe20d872f4ccc320e156f9389c50
SHA3-384 hash: 4e50eff2375bc15a9cd8f2b374d23920116d08548b02851a4c7d0edc7e40786624d7ee37509cb57d9420c39af0fda817
SHA1 hash: 357a8613b980f684216906d30e15881d5d00ec5d
MD5 hash: ae51e5a7cc2df014755ca4b05cafdb5c
humanhash: cup-aspen-gee-happy
File name:Order Inquiry - KV190520.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'219 bytes
First seen:2020-05-19 06:04:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:E9av34/xeju5SiTMy9PDkR17sM4SThvnkCYLt:Edxeju0iZIRaM42k7p
TLSH 36842395E07B0BD5DAADF6C0A16CE11A9EB3E2B8F3520C8011A5D7669CC127FD6F2071
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx19.dns.com.cn
Sending IP: 180.76.192.19
From: Cnwll <cnwll06@cnwll.com>
Subject: Inquiry -KV-190520
Attachment: Order Inquiry - KV190520.rar (contains "Order Inquiry - KV190520.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 06:37:05 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cbbj2wsnekqygqucwdhofzzzbbfz7ra3bzpjtgdedqvn6jytria._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f08214ead269150c1a141586771739c8425cfe20d872f4ccc320e156f9389c50

(this sample)

AgentTesla

Executable exe f18c54f75aac4793d30118e30aade5bbc01deabe6e0c75ac01529702f4a9e9d8

  
Dropping
MD5 91cbab9ce2926faf70242cd0a5eccc02
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f18c54f75aac4793d30118e30aade5bbc01deabe6e0c75ac01529702f4a9e9d8

Comments