MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18dbad15d17eb95e3565e45b7f3606e29f6562cd94b09ec7a832559ee0556747. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18dbad15d17eb95e3565e45b7f3606e29f6562cd94b09ec7a832559ee0556747
SHA3-384 hash: 9c0245810ae4c229264485551933bb9fe2a22f37b0081a64f5bb5b93a826cb697f97a97b586cba6513f29ffa8098d998
SHA1 hash: 8ded765462cd46089c228e9c37584655938a7c09
MD5 hash: 96fb6631b2a5b344fc932f787f9ccb16
humanhash: diet-fanta-cola-shade
File name:Order875653.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'098 bytes
First seen:2020-05-25 08:20:49 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:aqu9Xyd/qrewa/wQry5LwCdgZ2U1Z4YlITrNBUgUvn1ESIwHjBC0zfGQuRht:1uENgC05LwC+Zp4HvNmvnqGBZyht
TLSH D4842322C9B714D4EF7F7C0E483D02C7E86E9128A03ED582994149F21FF59665F263AE
Reporter abuse_ch
Tags:AgentTesla AveMariaRAT RAT z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: saurer.com
Sending IP: 95.211.208.57
From: Cemil Esen <Cemil.Esen@saurer.com>
Subject: Request for Quotation
Attachment: Order875653.z (contains "RFQ.pdf.exe")

AgentTesla payload URL:
http://clubcaddy.com/kest/look.exe

AgentTesla SMTP exfil server:
mail.kteadubai.com:587

AveMariaRAT C2:
qlox.duckdns.org:1738 (209.58.144.239)

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 10:38:27 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 18dbad15d17eb95e3565e45b7f3606e29f6562cd94b09ec7a832559ee0556747

(this sample)

AgentTesla

Executable exe a5c337beb2e41e7d67b1059947b120be8634c3365eff2e9e8b03a6a5d518c5de

  
URLhaus
https://urlhaus.abuse.ch/url/367836/
  
Dropping
MD5 9cfb4a3ed4d412c42b651e04e90d1e42
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5c337beb2e41e7d67b1059947b120be8634c3365eff2e9e8b03a6a5d518c5de

Comments