MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46cd5635bac840ab5baa76e7ad569d305291d86adf9f6c79f2b8a9d84b12f29e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46cd5635bac840ab5baa76e7ad569d305291d86adf9f6c79f2b8a9d84b12f29e
SHA3-384 hash: d1a7008b0f93261cfdfe227dd7db0275cd86c74b2cadaf5fd2dc24ea091a1d50620aefa361269de95f5d4784ec998f51
SHA1 hash: 65838ee7342719a52dcec9969311a63f07b22b34
MD5 hash: 15ae21a4cb7884d10bc8165ba418bf4b
humanhash: kilo-early-ceiling-autumn
File name:RFQ- Msasa installation Urgent.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'656 bytes
First seen:2020-08-18 12:10:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:pI9jlNuj3XOrhpTXIgS/7VW0trsGUi/aniTT:p0ZeXOJS/700Vanif
TLSH F69423F054E1493A0C12740BABC0E148283CA797256EB9A20F8E1425BA7BC7575F7BCB
Reporter abuse_ch
Tags:AgentTesla r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.confidencegroup.co
Sending IP: 162.144.54.78
From: Sales Petrolzim <sales@vaka.co.zw>
Reply-To: Sales Petrolzim <cri.sigmai@gmail.com>
Subject: RFQ- Msasa Material And Installation of CP 5 Steel Palisade Fencing
Attachment: RFQ- Msasa installation Urgent.r11 (contains "RFQ- Msasa installation Urgent.exe")

AgentTesla SMTP exfil server:
smtp.desmaindian.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46cd5635bac840ab5baa76e7ad569d305291d86adf9f6c79f2b8a9d84b12f29e/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:12:05 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3gvmnn2zbakww5ko3t22vu5gbjjdwdk36pwy6psxcu5qsys6kpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46cd5635bac840ab5baa76e7ad569d305291d86adf9f6c79f2b8a9d84b12f29e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 46cd5635bac840ab5baa76e7ad569d305291d86adf9f6c79f2b8a9d84b12f29e

(this sample)

AgentTesla

Executable exe 58df4d2cea8c94b519a4ef3b44a26236a318202a7f651fc8bf2fb65cf75942e8

  
Dropping
MD5 0affebfbb3319cb615ccf524a0e1e8ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 58df4d2cea8c94b519a4ef3b44a26236a318202a7f651fc8bf2fb65cf75942e8

Comments