MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31b1cf1a319dd1115f9e2b858056f1092f17b1c03c671b3e78c68b3673a924ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31b1cf1a319dd1115f9e2b858056f1092f17b1c03c671b3e78c68b3673a924ed
SHA3-384 hash: feceefa91317faaa89c684f5867d885e849dc362fd0b3432cc6dd5242447be1781ec5dbc541a0caef79c1ed477ab5ae0
SHA1 hash: 39fd1f8880516a0ca91f83fafb206b15acab5d41
MD5 hash: 017ef900c923b98a3e23358af777cfa7
humanhash: echo-failed-earth-bacon
File name:PO AO-200402_pdf.gz.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:952'530 bytes
First seen:2020-05-27 18:19:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:EbV2VRsaKd2KfdTn2/Cj7CXRGd0ObQBlAon9SMJU2cA+csfun8TvBvZhF8:FX76V2/Cj7sGGObOlyM62FQunyvZh2
TLSH 1F1533898DE489DB9F0E51D1D690AD4D3CDB6CBA2FC29452533AD9B453232AD3A0C6C3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: battirmedical.com
Sending IP: 103.99.1.147
From: Elias Khair<sales@battirmedical.com>
Subject: RE:URGENT - PO# AO-20
Attachment: PO AO-200402_pdf.gz.rar (contains "PO# AO-200402_pdf.gz.exe")

AgentTesla SMTP exfil server:
mail.parshavayealborz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 18:37:14 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 31b1cf1a319dd1115f9e2b858056f1092f17b1c03c671b3e78c68b3673a924ed

(this sample)

AgentTesla

Executable exe 5dcc9c1e15ffe2b5443d07490a733e9167ef47fed99cc3d494bf7674e9e472d0

  
Dropping
MD5 e7405dfccea1a169e94585d83cbf283b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5dcc9c1e15ffe2b5443d07490a733e9167ef47fed99cc3d494bf7674e9e472d0

Comments