MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 420237a9d8ecfa76777e8a04ce2a42247b7f5dc52a9ce256caf0a6803b1a21ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 420237a9d8ecfa76777e8a04ce2a42247b7f5dc52a9ce256caf0a6803b1a21ab
SHA3-384 hash: 1a132f74f51e443d5e9ea93eab09ad90e4a3f15404570ca9180d9269797e0728871fd8d0d6297765db83b3a87c3a72b8
SHA1 hash: 7eca44bf8999ffe5d54021d71d0015bf8bfefaab
MD5 hash: 79f1cf54c0b281b102a6461c877d2063
humanhash: iowa-angel-north-quiet
File name:ADNOC RFQ 978002410.tar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:796'263 bytes
First seen:2020-08-05 11:35:35 UTC
Last seen:Never
File type: tar
MIME type:application/x-rar
ssdeep 24576:UduvMnNnZgdJWaesGl62Cs2YrqaCECoI1lU:QBAIaesc6PwhCECL4
TLSH 4805333BB7B23ADB26AC2B1C412BA0F0145B98E8C455718C1EAF095F59F27BD594E0DC
Reporter abuse_ch
Tags:AgentTesla tar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: adnoc.ae
Sending IP: 37.49.224.210
From: Ali Mohamed Al Suwaidi (ADNOC - C&CM) <aalsuwaid2@adnoc.ae>
Subject: ADNOC RFQ 978002410 - Products Supplies Needed
Attachment: ADNOC RFQ 978002410.tar (contains "ADNOC RFQ 978002410.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/420237a9d8ecfa76777e8a04ce2a42247b7f5dc52a9ce256caf0a6803b1a21ab/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:37:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iibdpkoy5t5hm536ricm4kscer5x6xoffkooevwk6ctiaoy2egvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/420237a9d8ecfa76777e8a04ce2a42247b7f5dc52a9ce256caf0a6803b1a21ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 420237a9d8ecfa76777e8a04ce2a42247b7f5dc52a9ce256caf0a6803b1a21ab

(this sample)

AgentTesla

Executable exe 1fde5d84183254c2cf68f3c759f3cc90f3a96879d198aa97f1eeccbbf7d73933

  
Dropping
MD5 211dcb354320d4501c43f8d33b3a715a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1fde5d84183254c2cf68f3c759f3cc90f3a96879d198aa97f1eeccbbf7d73933

Comments