MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30bcb022ff079e522d8684b1f5952ab9ba9a45d975eaeb3d3d2175aee6aef284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30bcb022ff079e522d8684b1f5952ab9ba9a45d975eaeb3d3d2175aee6aef284
SHA3-384 hash: 73b4f93ecc702db879276ca74cc994d6ab025caad2d9db6dccb23f0d9e32af2acf4d283203af523ae1f2c2f3995137cb
SHA1 hash: 31254aea9d3a0f4226556cc6f42a8b74121b7515
MD5 hash: 6d28bfcbaaab08aecc72d77f213849cb
humanhash: colorado-july-william-wolfram
File name:Inquiry.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:624'729 bytes
First seen:2020-10-07 10:47:08 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:LZQt5ZtdyvRaOH4hFXhCwe6UIqfsU81OE63VKrzFQelLo2Ck0k2SHshziNXtnb:1QtzWOXhX77q61+3VKrzRSo/5
TLSH DDD4334AB30FECBF79F2492950D5B6BAC1154E4B8293DC8FC28838675D63FA5E06150B
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: outmx-267.london.gridhost.co.uk
Sending IP: 31.170.120.152
From: Alison Briese / AGT Foods Australia <ABriese@agtfoods.com>
Reply-To: Alison Briese?/AGT Foods Australis <Ventas@imagencolor.cl>
Subject: Re: Inquiry
Attachment: Inquiry.r00 (contains "Inquiry.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30bcb022ff079e522d8684b1f5952ab9ba9a45d975eaeb3d3d2175aee6aef284/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 09:56:19 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gc6laix7a6pfelmgqsy7lfjkxg5jurozoxvowpj5ef225zvo6kca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/30bcb022ff079e522d8684b1f5952ab9ba9a45d975eaeb3d3d2175aee6aef284

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 30bcb022ff079e522d8684b1f5952ab9ba9a45d975eaeb3d3d2175aee6aef284

(this sample)

AgentTesla

Executable exe a0062b106277324b51718baac12082f12f735f370173fa3073abf70b86b016be

  
Dropping
MD5 da828f6544e96bddef1c0e1535947f8f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a0062b106277324b51718baac12082f12f735f370173fa3073abf70b86b016be

Comments