MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11500f9d7c18d7b6ba8e0ef1969192d357f05c098babd2f24d78900a10bf007d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11500f9d7c18d7b6ba8e0ef1969192d357f05c098babd2f24d78900a10bf007d
SHA3-384 hash: 4a039d8b9b960d1e955aae3651611d42870113d191737e83233c62597d9862ada3ec85a922dbb9a313d715d783fa0e74
SHA1 hash: 3129855c676e0eadd84404560e7fa67834fe0562
MD5 hash: ea59e97eda00efa45554d057fc531b2a
humanhash: summer-mississippi-west-louisiana
File name:Scan copy of product images.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'792 bytes
First seen:2020-06-24 05:29:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2yo3YfWXiP4/5vTOKhKlAe7wU42H17WzpNcgIT+qbNfn3:29CzPq5FhUA07HH16tN+1/
TLSH 818423E10E5063A9C3F8D25629C21EDB857C8389E1C972C8AA8F4D1553C9E7D1CED83E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mfwd14.mailplug.co.kr
Sending IP: 14.63.174.49
From: 陈卓 <cz@switchkorea.com>
Subject: Scan copy of product images.rar
Attachment: Scan copy of product images.rar (contains "Scan copy of product images.exe")

AgentTesla SMTP exfil server:
almashosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11500f9d7c18d7b6ba8e0ef1969192d357f05c098babd2f24d78900a10bf007d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:31:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cfia7hl4ddl3nouob3yznems2nl7axajrov5f4snpciauef7ab6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 11500f9d7c18d7b6ba8e0ef1969192d357f05c098babd2f24d78900a10bf007d

(this sample)

AgentTesla

Executable exe 3fd5ba3e505eb66a8bb5d5eab88da4a0ca58d00ff474a8c0ab65e7843d98941c

  
Dropping
MD5 9c64ddbff8215e54659e62cf7a49c9c8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3fd5ba3e505eb66a8bb5d5eab88da4a0ca58d00ff474a8c0ab65e7843d98941c

Comments