MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 318432c3caf2d969f852ab3c903a5e6564602213f2ff47ab2e2edfcecd2cacee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 318432c3caf2d969f852ab3c903a5e6564602213f2ff47ab2e2edfcecd2cacee
SHA3-384 hash: ca0014845d540be491bb1a8a6b61edd027c3a6afeaccf479a1378e2d8fddd22737d40b20db93774baf51d664a105b8f3
SHA1 hash: f1e01c19601c185c22e24a733284d78d97f2a5a5
MD5 hash: dd1f58e029ed6e45c0d0b3a664408bce
humanhash: social-paris-steak-potato
File name:Scan_16-06-2020_1051_0001.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:826'046 bytes
First seen:2020-06-16 13:04:37 UTC
Last seen:2020-06-16 13:52:06 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:mEOWrbbvlS0SrO7WZlIdGEUEqBeHKunVAsLdm:mEOWrbTzSrlydqgHK8VAGc
TLSH 7C0533657C395E69F4C03FB79D62C1A16B280BB4DD6D80558B4F028989E979F0CE8F32
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: www1.webmail.pair.com
Sending IP: 209.68.6.94
From: Accountant <request@webmail.editage.com>
Subject: FWD: Funds Transfer Request #294685930 Has Been Scheduled
Attachment: Scan_16-06-2020_1051_0001.rar (contains "Scan_16-06-2020_1051_0001.bat")

AgentTesla SMTP exfil server:
mail.gimpex-imerys.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 13:06:06 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggcdfq6k6lmwt6csvm6jaos6mvsgaiqt6l7upkzof3p45tjmvtxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 318432c3caf2d969f852ab3c903a5e6564602213f2ff47ab2e2edfcecd2cacee

(this sample)

AgentTesla

Executable exe 776fb5cbe59ba8b6a887a0b16df118193097946a7129639c0ec42d23872bde3d

  
Dropping
MD5 00ac1ba0f49f54dbd535d8e58a5a2de6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 776fb5cbe59ba8b6a887a0b16df118193097946a7129639c0ec42d23872bde3d
  
Dropping
SHA256 8fde097813311d4dbd628091f54cb0f0b96df57ccae41925b0d8d9cb584a2ad0
  
Dropping
MD5 6697d6dd9247e6c7c877a60ec8afcbbd

Comments