MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36efea39e139dafe70ba588e54f1b81c5a0064a114b78caed5ef3203957a89ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36efea39e139dafe70ba588e54f1b81c5a0064a114b78caed5ef3203957a89ed
SHA3-384 hash: 9901c0e49c9b429e61f9d064c12668973f7c727f8531365b4fd85f4d510c46d1f8d56658bf0b0b97bac2a605ed6c0ef9
SHA1 hash: 98e69b4aadbb977eaa69bec002d3217582885297
MD5 hash: e7e7dafc4f53a9b575d2bf73f44206c7
humanhash: winner-butter-california-magnesium
File name:Payment Advice EUR10095372490 86F0.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:507'053 bytes
First seen:2020-10-26 15:07:37 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:XX1C0R8neJLGphqeeMLojMYaHJkuEAcvXNwZI7L5z4+c:XXzOkLNee3glHJ9fLa7V3c
TLSH BDB42363B2455FD6A12863C1F607AB3962135CFCF0BC2AC716C735A1F5AE52B02EA174
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail113.areaproject.net
Sending IP: 185.55.249.113
From: Bosch Group - AP Department <paymentsupporteu@bosch.com>
Subject: Bosch Global Payment Advice EU0095372490 86F0 | Customer due invoice settlement
Attachment: Payment Advice EUR10095372490 86F0.r00 (contains "Bosch Global Payment Advice EU0095372490 86F00.exe")

AgentTesla SMTP exfil server:
mail.corroshield.co.id:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36efea39e139dafe70ba588e54f1b81c5a0064a114b78caed5ef3203957a89ed/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 14:11:13 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g3x6uopbhhnp44f2lchfj4nydrnaazfbcs3yzlwv54zahfl2rhwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 36efea39e139dafe70ba588e54f1b81c5a0064a114b78caed5ef3203957a89ed

(this sample)

AgentTesla

Executable exe 9866933cc0ecf8e3ddfa7ce79cdbc70b16efbe819a2426ffa28d923a12c0653a

  
Dropping
MD5 62872acb9ff848df9f246ace267cff4f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9866933cc0ecf8e3ddfa7ce79cdbc70b16efbe819a2426ffa28d923a12c0653a

Comments