MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a7e94bebd2855a574f3e92f373d9cf2533fc588a293813625e7ea5e7b02102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30a7e94bebd2855a574f3e92f373d9cf2533fc588a293813625e7ea5e7b02102
SHA3-384 hash: daa2e554c2e40b8929dc589ecf3d44bc7c16be382ba62a00fff8b6c87aa71d5fc1f82268b8abfc753b638352827b13bb
SHA1 hash: 808bc4a2106cdc3bd2ba22f6b5d3c2468c4ebfe6
MD5 hash: 5b850b4b62e40b8a62ee5421db5b4d8b
humanhash: stairway-carpet-edward-moon
File name:PURCHASE LIST.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'929 bytes
First seen:2020-06-29 09:13:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:RsQ9lL9FwDXRpg7tpowju/z6lDkjCnaXwuuYGsdGKhYzfXP73hROWBC+KHUeePr3:RsQ9lL9tpM6lDkjEEwvscKhYzfmWI+Ks
TLSH B28423E27438BDB89D3A22C58D6E31817E711B6A4931FB9C504EF8D3D172EC6722A153
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tzdegree.com
Sending IP: 103.99.1.149
From: Chusui<chusui@tzdegree.com>
Subject: RE: NEW PO FROM ALANTECH CO.,LTD QTTY (PO#7A68D20) 
Attachment: PURCHASE LIST.rar (contains "PURCHASE LIST.exe")

AgentTesla SMTP exfil server:
mail.parshavayealborz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30a7e94bebd2855a574f3e92f373d9cf2533fc588a293813625e7ea5e7b02102/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 09:15:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gct6ss7l2kcvuv2ph2jpg46zz4sth7cyriutqe3clz7klz5qeeba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 30a7e94bebd2855a574f3e92f373d9cf2533fc588a293813625e7ea5e7b02102

(this sample)

AgentTesla

Executable exe ee40db183a9f86ee97dd3803b54d1711d443d25beb0160fd89cd54ad890b8485

  
Dropping
MD5 c092144bb729298d50c95d1a16d0aa97
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee40db183a9f86ee97dd3803b54d1711d443d25beb0160fd89cd54ad890b8485

Comments