MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 307efb209384279fdc27a08b40a2b0191ac28ed9e1dbcbd09f6d606875bd7eb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 307efb209384279fdc27a08b40a2b0191ac28ed9e1dbcbd09f6d606875bd7eb1
SHA3-384 hash: 9c40e0448ca500c6e45f166a1c1884b0d99d08f7a463f10b97e10870e355cfddf194d1c9f0f4fd1101ea27d8a1541930
SHA1 hash: 9c1d6936f35f3eb8caf3d329d6a7399280b39646
MD5 hash: 6bb9383e7cf839e8d72b1cd47eda7025
humanhash: edward-nine-pennsylvania-yellow
File name:signedMoU.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'839 bytes
First seen:2020-06-16 10:56:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:RByz+oXuWe4f7Ay/uENYf2sTBft61sYndXPB:OJjf7AQYeevIsy
TLSH 33942327A1DA77BFDB1C1802E3FB53409E4D5F5DA163A11262B192F1E833509BB88B4D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qproxy6-pub.mail.unifiedlayer.com
Sending IP: 69.89.23.12
From: Silva David <anuradhad@medtekindia.net>
Subject: Please let us know what you think about the new corrected documents
Attachment: signedMoU.rar (contains "signedMoU.exe")

AgentTesla SMTP exfil server:
mail.squarebpo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 10:58:07 UTC
AV detection:
19 of 30 (63.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gb7pwietqqtz7xbhucfubivqdenmfdwz4hn4xue7nvqgq5n5p2yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 307efb209384279fdc27a08b40a2b0191ac28ed9e1dbcbd09f6d606875bd7eb1

(this sample)

AgentTesla

Executable exe a519813c510c54192830efbf36d2554ac5dcaac0957a5ee933f03436b7b98937

  
Dropping
MD5 03c672dbb31f56970867b0a0236fcddd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a519813c510c54192830efbf36d2554ac5dcaac0957a5ee933f03436b7b98937

Comments