MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0840f177851a0fff04152f3a7d11fa3b8e94eaf8eb00274090e62553dea59deb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0840f177851a0fff04152f3a7d11fa3b8e94eaf8eb00274090e62553dea59deb
SHA3-384 hash: 4b6f202ef2056cb3bb11966e898b3cd398bef4dca2394f61bf8a572f1b042a93cc7283ead76910dcc574208376267d26
SHA1 hash: 4afa5d979a5b40135dbb76188de9302332cd123c
MD5 hash: ee194c69c6bdebac477c4d6d7304d8c4
humanhash: october-oven-mars-august
File name:Scan docs.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'345 bytes
First seen:2020-06-04 12:48:57 UTC
Last seen:2020-06-04 15:15:32 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:7qlltpa/2blDMFb6VCGsO6Py8Hdp3rbDijGB2ijpDcfwimK94v0cB:Ovu/2pDBCG2PNp3cM2ijpID94vdB
TLSH 218423FAE10C99543FFDBFA18686847FFCA049674274259330C5CE9B8F5944338A684B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.livemail.co.uk
Sending IP: 213.171.216.60
From: miqbal@jksugarmills.com
Reply-To: miqbal@jksuqarmills.com
Subject: RE: USD AMOUNT : 57000/= SWIFT MESSAGE - Remittance date 4TH JUNE 2020 -Swift enclosed for your Reference (Ref Q3 2019 Order)
Attachment: Scan docs.rar (contains "Scan docs.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 13:36:22 UTC
File Type:
Binary (Archive)
Extracted files:
258
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbapc54fdih76bavf45h2ep2hohjj2xy5macoqeq4ysvhxvftxvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0840f177851a0fff04152f3a7d11fa3b8e94eaf8eb00274090e62553dea59deb

(this sample)

AgentTesla

Executable exe 75928a9911adb30270a8d3a6585cd2e30cad897e35ce2273cc7705083074b534

  
Dropping
MD5 ecbb24d6a76b76a50fa12a838a06adb4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75928a9911adb30270a8d3a6585cd2e30cad897e35ce2273cc7705083074b534

Comments