MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30737a87fe4b83894abd9bf77182e0f6894e56fa7b74a25156dd76c6f814aa57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30737a87fe4b83894abd9bf77182e0f6894e56fa7b74a25156dd76c6f814aa57
SHA3-384 hash: e12a4879929b34aca913c6fa4b86a6924cdcfa65df2b5088a3ae2278439a148853d2c03619011147981a25dcddf20363
SHA1 hash: 26c2ad8e230635dcbede310695e3b3cb5e77b91c
MD5 hash: c8a4652cd58c8ce0ef778e20f72fadc1
humanhash: alabama-low-nebraska-colorado
File name:New inquiry CMSalgmN0 200000872525_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:570'676 bytes
First seen:2020-11-25 11:57:09 UTC
Last seen:2020-11-25 11:57:54 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:3gLgATtkuRDSIqS5jxQmTrHkKo/XSPKStfSmhJYfnjQ:YTtkAD1T5VjTrHkKgSPKqJYf0
TLSH 5AC423C8985EF4A9CD485B848B79F604D48E453A3F18523E750EEB50B863A3CF958C9E
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "<info@174.deltahost-ptr>" (likely spoofed)
Received: "from 176.107.178.174.deltahost-ptr (unknown [176.107.178.174]) "
Date: "Wed, 25 Nov 2020 12:30:44 +0200"
Subject: "Re: new request"
Attachment: "New inquiry CMSalgmN0 200000872525_pdf.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30737a87fe4b83894abd9bf77182e0f6894e56fa7b74a25156dd76c6f814aa57/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-25 11:58:05 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/30737a87fe4b83894abd9bf77182e0f6894e56fa7b74a25156dd76c6f814aa57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 30737a87fe4b83894abd9bf77182e0f6894e56fa7b74a25156dd76c6f814aa57

(this sample)

AgentTesla

Executable exe 0522494bc4a2bf38c14fc1bbbad35678d647c774c35c1597e294c815e773955c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0522494bc4a2bf38c14fc1bbbad35678d647c774c35c1597e294c815e773955c

Comments