MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f376add92e90dd85fc0c2ec71b183ccf15bcbfdcb1e013bff27fe6df713fde58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f376add92e90dd85fc0c2ec71b183ccf15bcbfdcb1e013bff27fe6df713fde58
SHA3-384 hash: 1aaa6161aa6b5530f4aae97c4c42992b85ca24876b08cb2c1f01c456fec83ca9f78ffd5505cc2d9308816ab2c7a1070b
SHA1 hash: 933769b10ac6efd05a462ddb6d7445891db9f77e
MD5 hash: 6e87f73671e13916b93af58330429f3b
humanhash: blossom-utah-earth-london
File name:CETC-Request.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:564'772 bytes
First seen:2020-05-04 17:25:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ydCpOYYnpsHcdvmoRT1hMgdJHd9igc6kKBRrW472NgCGtvbegjhNzHrFMK:y8pUC8dvLJMgdJHKv6kKbrWc2NRGtvqk
TLSH FCC423699F7311B712D5AC9FBD6064578C28E09E900EEC86266A6C2677429CCCF31D3F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway31.websitewelcome.com
Sending IP: 192.185.143.234
From: info@modevnigeria.com
Subject: FW: Inquiry for Urgent Purchase
Attachment: CETC-Request.rar (contains "CETC-Request.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 17:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6n3k3wjosdoyl7amf3drwgb4z4k3zp64whqbhp7sp7tn64j73zma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f376add92e90dd85fc0c2ec71b183ccf15bcbfdcb1e013bff27fe6df713fde58

(this sample)

AgentTesla

Executable exe 3363075fd1a09ada8858a47b099c702028f26705c5967633ee92f341817db3b3

  
Dropping
MD5 effed7e2c9577b71101867f764e647c4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3363075fd1a09ada8858a47b099c702028f26705c5967633ee92f341817db3b3

Comments