MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ad18c525899f5ed27a8ce28f4611dee5710cd686d0214dd5cd65cf32d73a0ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ad18c525899f5ed27a8ce28f4611dee5710cd686d0214dd5cd65cf32d73a0ad
SHA3-384 hash: 63285019a5155f2b0ad52a3602383380e2b97046cd61a32a10103e678a34d9a3274173f4ae69d698a64af77988a433b7
SHA1 hash: d84849af983da325f8e67e78cef369fb9416b6ad
MD5 hash: 2b3b76a35c183a73181368d6f637ce17
humanhash: social-avocado-fillet-lamp
File name:TRANSFER COPY..USD.bit.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:535'374 bytes
First seen:2020-06-02 10:38:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:K1FDpJqUNwD456lKwsD2CAZp6EeIc4OmjeZiHPgk5dA:6FqKwvO/AZXWqeAju
TLSH 20B42328FD68626CABEF75E0A7ED833D8185EE54CC07518C621CD2C8757CF0466AE4A7
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-729369.hostwindsdns.com
Sending IP: 142.11.196.208
From: FINANCIAL OFFICER <rutherford.c@bistroltd.com>
Subject: PAYMENT ADVICE (transfer copy)
Attachment: TRANSFER COPY..USD.bit.rar (contains "TRANSFER COPY..USD.bit.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Boilod
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 10:58:59 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dliyyusyth262j5izyupiyi55zlrbtlinubbjxk42zopglltucwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1ad18c525899f5ed27a8ce28f4611dee5710cd686d0214dd5cd65cf32d73a0ad

(this sample)

AgentTesla

Executable exe 0179500cd516e391d6e8c927436354894ea076fabd99dba7f512a0d9e176f630

  
Dropping
MD5 12b28e4c4666271a566223185f9eb4b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0179500cd516e391d6e8c927436354894ea076fabd99dba7f512a0d9e176f630

Comments