MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15b121c6bc9422913028b027e5c489a59072561a8085a444b1ccc600d13dac7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15b121c6bc9422913028b027e5c489a59072561a8085a444b1ccc600d13dac7d
SHA3-384 hash: 303a782bd7c0dd05a02ada1b880902550b3bcb86c5e6f42b659fdef59facb74e8cf32abbe9cbb066801fc9eeb0e6fc91
SHA1 hash: 3a2e5396a72d11eb3b39013f66f1e6d7bf2cf85d
MD5 hash: cd12f69e5c3738f9681a642c74f6678e
humanhash: table-mango-football-massachusetts
File name:RFQ FOR JULY ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'852 bytes
First seen:2020-06-29 07:52:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:HdhLjIk7BGRw4mPt+HWxnJeJaKQabkrRFnZ7PbK40EXpkJ2BpVl1tynIiw6DYA6b:HTjXcyNxnJhKjG/7m40ipkJQpVl1tyCR
TLSH 428423398FA8C72670C5B93E72C752A8B2FA6D95020F7D590A2B840F95F8C6C3FD5650
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.51
From: PC LEONG <purchasing@suntongseng.com>
Reply-To: PC LEONG <nealworkrestblades@yahoo.com>
Subject: RFQ FOR JULY ORDER
Attachment: RFQ FOR JULY ORDER.rar (contains "RFQ FOR JULY ORDER.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15b121c6bc9422913028b027e5c489a59072561a8085a444b1ccc600d13dac7d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:54:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwysdrv4sqrjcmbiwat6lrejuwihevq2qcc2irfrztdabuj5vr6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 15b121c6bc9422913028b027e5c489a59072561a8085a444b1ccc600d13dac7d

(this sample)

AgentTesla

Executable exe b3850a4a20e894c6b6510b89e84a93c91e48db0a5ae667c913ed212090308c8c

  
Dropping
MD5 f18bd14e8cdc7139806ca7b034fc4b45
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3850a4a20e894c6b6510b89e84a93c91e48db0a5ae667c913ed212090308c8c

Comments