MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1474aa8339ff6c6b6b8179043b2abc8f6e1cbaab7cd8fce7b7c2ca9c31f0269f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1474aa8339ff6c6b6b8179043b2abc8f6e1cbaab7cd8fce7b7c2ca9c31f0269f
SHA3-384 hash: 3e3c11452869320cb2e223e1d3a50959a5b533b033e1692e8f709b74fa9940ab17f6bafc247466750e89873f5c225824
SHA1 hash: 86473c1b103b665a44d7a617339696d8d3ea7414
MD5 hash: 0ab3612157eeb5fa7b2e73755aff81ea
humanhash: mexico-quebec-tennis-hawaii
File name:recharges.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'530 bytes
First seen:2020-08-11 13:58:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:R3oWNg2q0PC3vvqAiWqwOrS5O/6nLMpmwKyoMgm+orFEZ:R3oWyJ0K3vPqjS7gpmsqm5c
TLSH 915422A187A83DD2D9884D5CD82C5369027AFE36105C29FB3E71AD8D37C9F8C66E5C09
Reporter abuse_ch
Tags:AgentTesla Outlook rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: EUR02-AM5-obe.outbound.protection.outlook.com
Sending IP: 40.92.67.54
From: beatrice dizy <dizys2@msn.com>
Subject: Voici les reçu
Attachment: recharges.rar (contains "recharges.exe")

AgentTesla SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1474aa8339ff6c6b6b8179043b2abc8f6e1cbaab7cd8fce7b7c2ca9c31f0269f/
Threat name:
ByteCode-MSIL.Trojan.Pretoria
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:00:13 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cr2kvazz75wgw24bpecdwkv4r5xbzovlptmpzz5xylfjympqe2pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1474aa8339ff6c6b6b8179043b2abc8f6e1cbaab7cd8fce7b7c2ca9c31f0269f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1474aa8339ff6c6b6b8179043b2abc8f6e1cbaab7cd8fce7b7c2ca9c31f0269f

(this sample)

AgentTesla

Executable exe 76aae91b7f532cb38c1848495595dbd02d6ded35faae729a5bfc65c69d17eef8

  
Dropping
MD5 6fa5fc629c06d3e63a8c22876c91695e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 76aae91b7f532cb38c1848495595dbd02d6ded35faae729a5bfc65c69d17eef8

Comments