MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9fc30c88a7b440381a12c3f08f862288fcb52116c1dc2a41f9373431f1a7f6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9fc30c88a7b440381a12c3f08f862288fcb52116c1dc2a41f9373431f1a7f6e
SHA3-384 hash: 80a9f4aa58ef6ecd3a475f74fde82a9630e83857d162dea43e766e3afa007240bd7a213e1100c89bd2c6cf8cbd9a7bf5
SHA1 hash: fe3a900bf9740e6780953612a92d8f046ad89460
MD5 hash: 8e7c30e148bcb56faef6654be0cf83f7
humanhash: football-michigan-bacon-oscar
File name:New Inquiry Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'126 bytes
First seen:2020-06-12 06:57:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:yjoNy7hzs60hyI7387IUEoydXKlly/NxnkeHNkUuTQb:yey7ONsW3ijlRl0VHuUuTQb
TLSH B494236CC97B0DDEB08FED5453A5DB5C106A399192B7AD32E510CFAAA03384DC42D3E1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp111.iad3a.emailsrvr.com
Sending IP: 173.203.187.111
From: Sales <rami@smarttours-jo.com>
Subject: Inquiry :Rfq for Quotation Order against (Enq# 9006) Urgent!
Attachment: New Inquiry Order.rar (contains "New Inquiry Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:59:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7h6dbsekpncahanbfq7qr6dcfch4wuqrnqo4fja7snzughy2p5xa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f9fc30c88a7b440381a12c3f08f862288fcb52116c1dc2a41f9373431f1a7f6e

(this sample)

AgentTesla

Executable exe e2840ae4fd1e84f80623c031bacba1cf0f11afeb1a4e06a50b5178ecc8094e18

  
Dropping
MD5 f1b6cc72dbc31a2991520f77b7af10b4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2840ae4fd1e84f80623c031bacba1cf0f11afeb1a4e06a50b5178ecc8094e18

Comments