MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ad872e13d41e8fe3b7511bfa2970e044119d4d2ecb0d3544e3354d16f28c5c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ad872e13d41e8fe3b7511bfa2970e044119d4d2ecb0d3544e3354d16f28c5c8
SHA3-384 hash: fe0b71150c7d9787eb63175a1718ac2596b8e3fdac809988afb8fe783303752104d1e1bb7c9fa75192ab7e21deccd305
SHA1 hash: 50bb5a1e8ae45cafff0175c34227575bef60f54d
MD5 hash: e1979df0c2a2ef510648251eba0de118
humanhash: bulldog-three-maryland-potato
File name:R2100131410.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'918 bytes
First seen:2020-05-26 10:01:36 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:M1H8oamntDU3V7C4+rQGbqPCf4Vw94IbCK1EeEX:2HZntDEV7C4+JqaNV1Ee6
TLSH 16A4233284B3B9EE8F4AAE23CE18790420EF93735DB5D089D275830F445BAA50EDD965
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 7star-ocean.com
Sending IP: 209.58.149.66
From: Suzan Jaafar <info@7star-ocean.com>
Subject: REQUEST FOR QUOTATION (RFQ REF : R2100131410)
Attachment: R2100131410.gz (contains "R2100131410.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:41 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 3ad872e13d41e8fe3b7511bfa2970e044119d4d2ecb0d3544e3354d16f28c5c8

(this sample)

AgentTesla

Executable exe f1c4b368cec98b2204aaaeb9928d5dcbe7cd779b75135a0b6e79dde2f6936259

  
Dropping
MD5 d193e4c44cee1adc88628b94a5acc0ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1c4b368cec98b2204aaaeb9928d5dcbe7cd779b75135a0b6e79dde2f6936259

Comments