MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f112efdbb6706e217e265078cd7f24f18b1de864d9a364f2281056c0b1abca5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f112efdbb6706e217e265078cd7f24f18b1de864d9a364f2281056c0b1abca5d
SHA3-384 hash: ebcee371786cc76f05f4e2b4d5f0c9bef26e9734664a1c90a0db06853f939a227ea9da73d61755a33f750a8192f6e2c3
SHA1 hash: e65db636a19e9fda84956ede03cd5de949d34de1
MD5 hash: 83c57f40360b5953f3e1289b869a2e7f
humanhash: hot-blossom-winner-cat
File name:IMG-20200514-OWA001.r12
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'993 bytes
First seen:2020-05-14 07:33:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:bp/BIa68oKpOLZSimHtqVfvXBFoBfTta2AV+TSaN6R8oqJM9ekzH400NoFc:1/BS52c3DZQBfTtRA469qJUTHDiwc
TLSH 9A94236B1DB8AC8451C415EDF6FBB1CED7B94CE822367949701016AA7B3CE3AC9412D3
Reporter abuse_ch
Tags:AgentTesla r12


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smarthost1.gohsphere.com
Sending IP: 199.127.218.11
From: Aqeel Abbas Rawjani <orders@elmedinstruments.com>
Subject: Re: Re AW: AW: New order
Attachment: IMG-20200514-OWA001.r12 (contains "20200514-OWA001.exe")

AgentTesla SMTP exfil server:
smtp.rncalpineplumbing.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ejo7w5wobxcc7rgkb4m27ze6gfr32de3grwj4ricblmbmnlzjoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f112efdbb6706e217e265078cd7f24f18b1de864d9a364f2281056c0b1abca5d

(this sample)

AgentTesla

Executable exe ebf440e63fc784b4e3143f513d80450d335c15dfb1dc3d7481eb19e385c74a35

  
Dropping
MD5 67d0d49175ebcd9942d3b49b64b9b764
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ebf440e63fc784b4e3143f513d80450d335c15dfb1dc3d7481eb19e385c74a35

Comments